PT-2024-26758 · Linux+10 · Linux Kernel+10
Published
2024-05-17
·
Updated
2026-05-26
·
CVE-2024-35839
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue arises when an skb is added to a neigh->arp queue while waiting for an arp reply, and the original skb's skb->dev can be different from neigh's neigh->dev. This can occur in bridging scenarios, such as when a dnated skb is sent from one veth to another, and the skb is added to a neigh->arp queue of the bridge. As a result, skb->dev can be reset back to nf bridge->physindev and used, potentially leading to a crash due to the lack of an explicit mechanism preventing physindev from being freed. The vulnerability can be exploited through the
arp process, neigh update, br nf dev xmit, br nf pre routing finish bridge slow, and br handle frame finish functions.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu