PT-2024-32178 · Linux+6 · Linux Kernel+6
Alphonse Kurian
·
Published
2024-09-04
·
Updated
2025-09-29
·
CVE-2024-46763
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.52
Description
A null pointer dereference vulnerability was found in the Linux kernel's GRO (Generic Receive Offload) handler. The issue occurs when the
fou gro receive function is called while shutting down a host, and the sk->sk user data pointer is null. This happens because the udp tunnel sock release function sets sk->sk user data to null when the tunnel socket is destroyed after a single RCU (Read-Copy Update) grace period. As a result, the fou gro receive function may attempt to access the null pointer, leading to a kernel crash.To mitigate this issue, the
rcu dereference sk user data function should be used in fou from sock to ensure that the sk->sk user data pointer is properly referenced. Additionally, null checks should be added to the FOU GRO handlers to prevent the null pointer dereference.Recommendations
To resolve this issue, update the Linux kernel to version 6.6.52 or later. If an update is not possible, consider applying the patch that adds the
rcu dereference sk user data function and null checks to the FOU GRO handlers. As a temporary workaround, consider disabling the GRO feature until a patch is available.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu