Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system handles specific TCP network traffic timing, leading to a 'null pointer dereference' that halts the operating system. This primarily impacts system availability, potentially causing service outages on affected servers.
Technical details
A NULL pointer dereference exists in the Linux kernel's TCP stack within the tcp_rearm_rto() and tcp_rto_delta_us() functions. The vulnerability is triggered when the kernel attempts to access a socket buffer (skb) that is NULL during Tail Loss Probe (TLP) or RACK (Recent ACKnowledgment) processing. An attacker or specific network conditions can trigger this code path, resulting in a kernel panic. The fix involves adding a check to ensure the skb is non-NULL before it is accessed in tcp_rto_delta_us(). Patches have been released for multiple stable kernel branches including 5.4.y and later.
Affected products
- Linux Linux Kernel 5.4.0-174-generic and other stable branches
Timeline
- 2024-09-10: other: Patch authored
- 2024-10-21: advisory: CVE published in NVD
References
- https://git.kernel.org/stable/c/09aea49fbc7e755a915c405644f347137cdb62b0
- https://git.kernel.org/stable/c/16e0387d87fc858e34449fdf2b14ed5837f761db
- https://git.kernel.org/stable/c/570f7d8c9bf14f041152ba8353d4330ef7575915
- https://git.kernel.org/stable/c/5c4c03288a4aea705e36aa44119c13d7ee4dce99
- https://git.kernel.org/stable/c/81d18c152e3f82bacadf83bc0a471b2363b9cc18
- https://git.kernel.org/stable/c/96c4983eab2a5da235f7fff90beaf17b008ba029
- https://git.kernel.org/stable/c/ad4f0a14d6856e68f023fc4e5017cfd881a3dfbc