CVE-2024-35886

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix infinite recursion in fib6_dump_done().

syzkaller reported infinite recursive calls of fib6_dump_done() during

netlink socket destruction. [1]

From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then

the response was generated. The following recvmmsg() resumed the dump

for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due

to the fault injection. [0]

12:01:34 executing program 3:

r0 = socket$nl_route(0x10, 0x3, 0x0)

sendmsg$nl_route(r0, ... snip ...)

recvmmsg(r0, ... snip ...) (fail_nth: 8)

Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call

of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped

receiving the response halfway through, and finally netlink_sock_destruct()

called nlk_sk(sk)->cb.done().

fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it

is still not NULL. fib6_dump_end() rewrites nlk_sk(

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References