CVE-2024-26669

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: flower: Fix chain template offload

When a qdisc is deleted from a net device the stack instructs the

underlying driver to remove its flow offload callback from the

associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack

then continues to replay the removal of the filters in the block for

this driver by iterating over the chains in the block and invoking the

'reoffload' operation of the classifier being used. In turn, the

classifier in its 'reoffload' operation prepares and emits a

'FLOW_CLS_DESTROY' command for each filter.

However, the stack does not do the same for chain templates and the

underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when

a qdisc is deleted. This results in a memory leak [1] which can be

reproduced using [2].

Fix by introducing a 'tmplt_reoffload' operation and have the stack

invoke it with the appropriate arguments as part of the replay.

Implemen

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References