CVE-2024-44989

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix xfrm real_dev null pointer dereference

We shouldn't set real_dev to NULL because packets can be in transit and

xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume

real_dev is set.

Example trace:

kernel: BUG: unable to handle page fault for address: 0000000000001030

kernel: bond0: (slave eni0np1): making interface the new active one

kernel: #PF: supervisor write access in kernel mode

kernel: #PF: error_code(0x0002) - not-present page

kernel: PGD 0 P4D 0

kernel: Oops: 0002 [#1] PREEMPT SMP

kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12

kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014

kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim]

kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA

kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References