Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow a local user to cause a system crash. This occurs during specific network interface operations, potentially leading to a denial-of-service condition. The issue affects systems running various versions of the Linux kernel and has been addressed in recent updates.
Technical details
A NULL pointer dereference vulnerability exists in the rt6_uncached_list_flush_dev() function within net/ipv6/route.c of the Linux kernel. The flaw was introduced by a previous commit that accidentally removed a necessary check for the rt6i_idev pointer. An attacker with local access can trigger this vulnerability during network device unregistration or when disabling IPv6 on an interface, leading to a general protection fault and system crash. The fix re-introduces the NULL check before accessing the device member of the rt6i_idev structure. Patches have been released for multiple stable kernel branches including 6.1, 6.6, 6.10, and 6.11.
Affected products
- Linux Linux Kernel 6.11-rc6 and earlier versions
Timeline
- 2024-09-13: patched: Initial fix committed to the Linux kernel tree.
- 2024-10-21: advisory: CVE-2024-47707 published.
References
- https://git.kernel.org/stable/c/04ccecfa959d3b9ae7348780d8e379c6486176ac
- https://git.kernel.org/stable/c/08409e401622e2896b4313be9f781bde8a2a6a53
- https://git.kernel.org/stable/c/0ceb2f2b5c813f932d6e60d3feec5e7e713da783
- https://git.kernel.org/stable/c/8a8b83016f06805775db099c8377024b6fa5b975
- https://git.kernel.org/stable/c/9a0ddc73be37d19dff1ba08290af34e707d18e50
- https://git.kernel.org/stable/c/a61a174280dad99f25a7dee920310885daf2552b
- https://git.kernel.org/stable/c/e43dd28405e6b9935279996725ee11e6306547a5