Executive brief
A vulnerability exists in the Linux kernel's networking subsystem that could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs in the component responsible for managing network neighbor notifications, which lacks proper memory protection during certain operations. This could lead to a 'use-after-free' condition, impacting the overall stability and security of the operating system.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's net/core/neighbour.c component. The function __neigh_notify() can be invoked without the necessary RTNL (Routing Netlink) or RCU (Read-Copy-Update) protection when accessing network device structures. This lack of synchronization allows a race condition where the underlying network namespace or device could be freed while still being accessed. An attacker with local access could exploit this to trigger memory corruption, leading to a kernel panic or potential arbitrary code execution. The fix introduces proper rcu_read_lock() and rcu_read_unlock() primitives to ensure the network device remains valid during notification processing.
Affected products
- Linux Linux Kernel 2.6.25 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4
Timeline
- 2025-02-07: other: Patch authored by Eric Dumazet
- 2025-02-26: disclosed: Vulnerability disclosed by kernel.org
- 2025-02-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379
- https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1
- https://git.kernel.org/stable/c/559307d25235e24b5424778c7332451b6c741159
- https://git.kernel.org/stable/c/784eb2376270e086f7db136d154b8404edacf97b
- https://git.kernel.org/stable/c/8666e9aab801328c1408a19fbf4070609dc0695a
- https://git.kernel.org/stable/c/becbd5850c03ed33b232083dd66c6e38c0c0e569
- https://git.kernel.org/stable/c/cdd5c2a12ddad8a77ce1838ff9f29aa587de82df