Executive brief
A vulnerability in the Linux kernel's GENEVE networking component could allow a local user to cause a system crash or potentially execute unauthorized code. GENEVE is a protocol used for virtualizing networks, often in cloud or data center environments. This flaw occurs when network interfaces are deleted but internal references to them remain, leading to memory corruption when new interfaces are created.
Technical details
A use-after-free vulnerability exists in the Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) driver. The issue stems from geneve_configure() linking a 'geneve_dev' structure to a network namespace that may differ from the device's own namespace (e.g., when using IFLA_NET_NS_PID). When the device's namespace is dismantled, the device is freed, but its pointer remains linked in the backend UDP socket's namespace list. A subsequent attempt to create a new GENEVE device in that namespace triggers a use-after-free during the search for existing devices in geneve_find_dev(). The fix involves ensuring geneve_dellink() is called during tunnel destruction to properly unlink the device.
Affected products
- Linux Linux Kernel 6.13.0-g0ad9617c78ac
Timeline
- 2025-02-13: patched: Initial patch authored
- 2025-03-12: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3ce92ca990cfac88a87c61df3cc0b5880e688ecf
- https://git.kernel.org/stable/c/5a0538ac6826807d6919f6aecbb8996c2865af2c
- https://git.kernel.org/stable/c/788dbca056a8783ec063da3c9d49a3a71c76c283
- https://git.kernel.org/stable/c/904e746b2e7fa952ab8801b303ce826a63153d78
- https://git.kernel.org/stable/c/9593172d93b9f91c362baec4643003dc29802929
- https://git.kernel.org/stable/c/d5e86e27de0936f3cb0a299ce519d993e9cf3886
- https://git.kernel.org/stable/c/da9b0ae47f084014b1e4b3f31f70a0defd047ff3