Executive brief
A vulnerability in the Linux kernel's networking component could allow the system to leak small amounts of internal memory data over the network. This occurs when the system sends certain automated response messages (TCP resets) in IPv6 environments. While the leaked data is small, it could potentially expose sensitive information about the system's memory state to a remote observer.
Technical details
A use of uninitialized resource vulnerability (CWE-908) was identified in the nf_reject_ipv6 module of the Linux kernel. Specifically, the function nf_reject_ip6_tcphdr_put() failed to properly initialize the four reserved bits (th->res1) of the TCP header before transmission. This resulted in 'garbage' data from kernel memory being included in TCP RST packets sent via IPv6. The issue was discovered by syzbot using KMSAN (KernelMemorySanitizer). The fix involves using skb_put_zero() to ensure the entire TCP header is zero-initialized before use, consistent with the IPv4 implementation. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the October 2024 patches
Timeline
- 2024-09-13: patched: Initial patch authored by Eric Dumazet
- 2024-10-21: advisory: CVE-2024-47685 published
References
- https://git.kernel.org/stable/c/10210658f827ad45061581cbfc05924b723e8922
- https://git.kernel.org/stable/c/7a7b5a27c53b55e91eecf646d1b204e73fa4af93
- https://git.kernel.org/stable/c/7bcbc4cda777d26c88500d973fad0d497fc8a82e
- https://git.kernel.org/stable/c/7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2
- https://git.kernel.org/stable/c/872eca64c3267dbc5836b715716fc6c03a18eda7
- https://git.kernel.org/stable/c/9c778fe48d20ef362047e3376dee56d77f8500d4
- https://git.kernel.org/stable/c/af4b8a704f26f38310655bad67fd8096293275a2