Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system attempts to access network configuration data while a process is exiting, leading to a 'null pointer dereference.' This results in a denial-of-service (system 'Oops') that disrupts operations and requires a reboot.
Technical details
A NULL pointer dereference exists in net/sctp/sysctl.c within the proc_sctp_do_rto_min and proc_sctp_do_rto_max functions. The vulnerability is caused by the code incorrectly accessing the 'net' structure via 'current->nsproxy', which can be NULL if the current task is in the process of exiting (e.g., during an acct(2) syscall). A local attacker can trigger this 'Oops' to cause a denial of service. The fix involves obtaining the 'net' structure from 'table->data' using 'container_of()' instead of relying on the volatile 'current' task state. Patches have been released for multiple stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 3.13 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6
Timeline
- 2025-01-08: patched: Initial patch authored
- 2025-01-19: disclosed: CVE published
- 2025-02-27: advisory: NIST initial analysis completed
References
- https://git.kernel.org/stable/c/0f78f09466744589e420935e646ae78212a38290
- https://git.kernel.org/stable/c/246428bfb9e7db15c5cd08e1d0eca41b65af2b06
- https://git.kernel.org/stable/c/4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482
- https://git.kernel.org/stable/c/9fc17b76fc70763780aa78b38fcf4742384044a5
- https://git.kernel.org/stable/c/c87f1f6ade56c711f8736901e330685b453e420e
- https://git.kernel.org/stable/c/c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9
- https://git.kernel.org/stable/c/dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f