Executive brief
A vulnerability in the Linux kernel's networking component can cause a system crash (kernel panic). This occurs when the system processes specific types of network traffic through a virtualized network bridge (VxLAN). An attacker or a specific network configuration could trigger this to disrupt service availability.
Technical details
A NULL pointer dereference exists in the br_netfilter module of the Linux kernel. The issue occurs in br_nf_dev_queue_xmit when processing untagged frames larger than the VxLAN MTU. When such frames are forwarded to a VxLAN bridge port, br_handle_egress_vlan_tunnel changes the socket buffer destination (skb_dst) to a metadata type. Subsequent calls to ip_skb_dst_mtu attempt to access this destination as a valid device pointer, resulting in a crash. The fix involves dropping these unsupported packets instead of attempting fragmentation. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.8.0-rc3-g5b3fbd61b9d1 and earlier versions
Timeline
- 2024-10-21: advisory: CVE published in NVD
- 2024-10-17: patched: Fix committed to stable kernel tree
References
- https://git.kernel.org/stable/c/3453f5839420bfbb85c86c61e49f49ffd0f041c4
- https://git.kernel.org/stable/c/75dfcb758015c97e1accd6340691fca67d363bed
- https://git.kernel.org/stable/c/78ed917133b118661e1fe62d4a85d5d428ee9568
- https://git.kernel.org/stable/c/915717e0bb9837cc5c101bc545af487bd787239e
- https://git.kernel.org/stable/c/95c0cff5a1a5d28bf623b92eb5d1a8f56ed30803
- https://git.kernel.org/stable/c/cce8419b8168f6e7eb637103a47f916f3de8bc81
- https://git.kernel.org/stable/c/f07131239a76cc10d5e82c19d91f53cb55727297