CVE-2024-35969

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it

still means hlist_for_each_entry_rcu can return an item that got removed

from the list. The memory itself of such item is not freed thanks to RCU

but nothing guarantees the actual content of the memory is sane.

In particular, the reference count can be zero. This can happen if

ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry

from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all

references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough

timing, this can happen:

1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry.

2. Then, the whole ipv6_del_addr is executed for the given entry. The

reference count drops to zero and kfree_rcu is scheduled.

3. ipv6_get_ifaddr continues and tries to increments the reference count

(in6_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References