PT-2024-33886 · Linux+7 · Linux Kernel+7
Andy Roulin
·
Published
2024-10-21
·
Updated
2025-10-03
·
CVE-2024-50045
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.58
Description:
A kernel panic can occur in the br netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br nf dev queue xmit. The issue is dependent on the br netfilter module being loaded, net.bridge.bridge-nf-call-iptables set to 1, a bridge with a VxLAN netdevice as a bridge port, and untagged frames with size higher than the VxLAN MTU forwarded or flooded. The crash occurs because the ip dst mtu function tries to use the skb dst(skb) as if it was a valid dst with valid dst->dev.
Recommendations:
Update to Linux kernel version 6.6.58 or later to resolve the issue. As a temporary workaround, consider disabling the br netfilter module or restricting the use of VxLAN devices to minimize the risk of exploitation.
Exploit
Fix
NULL Pointer Dereference
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu