CVE-2024-35839

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: replace physindev with physinif in nf_bridge_info

An skb can be added to a neigh->arp_queue while waiting for an arp

reply. Where original skb's skb->dev can be different to neigh's

neigh->dev. For instance in case of bridging dnated skb from one veth to

another, the skb would be added to a neigh->arp_queue of the bridge.

As skb->dev can be reset back to nf_bridge->physindev and used, and as

there is no explicit mechanism that prevents this physindev from been

freed under us (for instance neigh_flush_dev doesn't cleanup skbs from

different device's neigh queue) we can crash on e.g. this stack:

arp_process

neigh_update

skb = __skb_dequeue(&neigh->arp_queue)

neigh_resolve_output(..., skb)

...

br_nf_dev_xmit

br_nf_pre_routing_finish_bridge_slow

skb->dev = nf_bridge->physindev

br_handle_frame_finish

Let's use plain ifindex instead

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References