Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue exists in the Netfilter component, which handles network traffic filtering and routing. An exploit could lead to a denial-of-service condition, impacting the availability of the affected system.
Technical details
A concurrency issue was discovered in the Linux kernel's Netfilter nf_tables component. Specifically, nf_dup_ipv4() and nf_dup_ipv6() could write to the per-CPU variable 'nf_skb_duplicated' in an unsafe, preemptible manner. While preemption was partially addressed, the root cause required disabling soft interrupts (bottom halves) to prevent re-entrancy and subsequent data corruption. A local attacker could potentially trigger this race condition to cause a kernel panic (denial of service). The vulnerability has been patched across multiple stable kernel branches by implementing local_bh_disable() and local_bh_enable() around the critical sections.
Affected products
- Linux Linux Kernel 4.3 to 4.19.323, 4.20 to 5.4.285, 5.5 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.11.0-rc7
Timeline
- 2024-09-26: patched: Initial patch authored by Eric Dumazet
- 2024-10-21: advisory: CVE-2024-49952 published by NVD
References
- https://git.kernel.org/stable/c/38e3fd0c4a2616052eb3c8f4e6f32d1ff47cd663
- https://git.kernel.org/stable/c/4e3542f40f3a94efa59ea328e307c50601ed7065
- https://git.kernel.org/stable/c/50067d8b3f48e4cd4c9e817d3e9a5b5ff3507ca7
- https://git.kernel.org/stable/c/531754952f5dfc4b141523088147071d6e6112c4
- https://git.kernel.org/stable/c/752e1924604254f1708f3e3700283a86ebdd325d
- https://git.kernel.org/stable/c/92ceba94de6fb4cee2bf40b485979c342f44a492
- https://git.kernel.org/stable/c/b40b027a0c0cc1cb9471a13f9730bb2fff12a15b