CVE-2024-57901 in Linux
Summary
by MITRE • 01/15/2025
In the Linux kernel, the following vulnerability has been resolved:
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found
by syzbot.
Rework vlan_get_protocol_dgram() to not touch skb at all, so that it can be used from many cpus on the same skb.
Add a const qualifier to skb argument.
[1]
skbuff: skb_under_panic: text:ffffffff8a8ccd05 len:29 put:14 head:ffff88807fc8e400 data:ffff88807fc8e3f4 tail:0x11 end:0x140 dev: ------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 5892 Comm: syz-executor883 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]
RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0b 8d 48 c7 c6 86 d5 25 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 5a 69 79 f7 48 83 c4 20 90 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc900038d7638 EFLAGS: 00010282 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 609ffd18ea660600 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802483c8d0 R08: ffffffff817f0a8c R09: 1ffff9200071ae60 R10: dffffc0000000000 R11: fffff5200071ae61 R12: 0000000000000140 R13: ffff88807fc8e400 R14: ffff88807fc8e3f4 R15: 0000000000000011 FS: 00007fbac5e006c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbac5e00d58 CR3: 000000001238e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_protocol_dgram+0x165/0x290 net/packet/af_packet.c:585 packet_recvmsg+0x948/0x1ef0 net/packet/af_packet.c:3552 sock_recvmsg_nosec net/socket.c:1033 [inline]
sock_recvmsg+0x22f/0x280 net/socket.c:1055 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline]
do_recvmmsg+0x426/0xab0 net/socket.c:2940 __sys_recvmmsg net/socket.c:3014 [inline]
__do_sys_recvmmsg net/socket.c:3037 [inline]
__se_sys_recvmmsg net/socket.c:3030 [inline]
__x64_sys_recvmmsg+0x199/0x250 net/socket.c:3030 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/09/2026
The vulnerability CVE-2024-57901 resides within the Linux kernel's packet socket implementation, specifically in the af_packet subsystem responsible for handling raw packet sockets. This flaw manifests in the `vlan_get_protocol_dgram()` function which is invoked during packet reception operations, particularly when using the MSG_PEEK flag in socket receive calls. The issue arises from a missing code path handling in the function that processes virtual LAN (VLAN) packet protocol detection, leading to a kernel crash due to improper handling of socket buffer structures. The root cause stems from the function attempting to modify socket buffer metadata without proper synchronization, especially when multiple CPU cores access the same socket buffer concurrently. This vulnerability was identified through automated fuzzing by syzbot, which revealed a critical kernel BUG triggered by a specific sequence of operations involving packet peeking and VLAN processing. The crash occurs in the `skb_under_panic` function within `skbuff.c`, indicating that the socket buffer's internal consistency has been violated, specifically at line 206 where an invalid opcode is executed due to corrupted buffer state.
The technical implementation flaw involves the `vlan_get_protocol_dgram()` function in `net/packet/af_packet.c` which was not properly accounting for the MSG_PEEK case during packet processing. When MSG_PEEK is used, the function should avoid modifying the socket buffer since it's meant to peek at data without consuming it. However, the original implementation failed to handle this specific flag properly, causing the function to attempt operations on socket buffer metadata that could lead to buffer overruns or underflows. The function's design allowed it to modify socket buffer structures directly, which created race conditions when multiple CPUs accessed the same socket buffer simultaneously. This design pattern violates fundamental kernel safety principles and aligns with CWE-119 Improper Access to Memory in the Common Weakness Enumeration catalog, specifically addressing memory access violations and buffer overflows. The vulnerability demonstrates a classic example of improper synchronization in concurrent kernel code, where shared data structures are accessed without proper locking mechanisms, resulting in undefined behavior and potential system crashes.
The operational impact of this vulnerability is severe as it can lead to complete system crashes or denial of service conditions in systems running affected Linux kernels. Attackers could exploit this vulnerability by crafting specific socket operations involving VLAN packets with MSG_PEEK flags, potentially causing system instability or forcing kernel panics that require system reboot. The vulnerability affects systems using packet sockets with VLAN capabilities, particularly those implementing network monitoring, packet capture, or network analysis functions. Given that this vulnerability can be triggered through standard socket system calls, it presents a significant risk to network services, network monitoring tools, and any application relying on packet socket functionality. The crash occurs in kernel space, making it particularly dangerous as it can compromise the entire system stability. This aligns with ATT&CK technique T1499.004, which involves network disruption through kernel-level attacks, and represents a critical security weakness in the Linux kernel's network stack implementation.
The recommended mitigation strategy involves applying the kernel patch that reworks the `vlan_get_protocol_dgram()` function to eliminate all direct socket buffer modifications and ensure thread-safe access patterns. The fix implements a design change that removes the problematic socket buffer manipulation entirely by avoiding direct skb access, thus preventing concurrent access issues. The patch adds a const qualifier to the skb argument to enforce read-only access and prevents any modifications to the socket buffer structure during protocol detection. This approach follows the principle of least privilege and ensures that functions accessing shared kernel data structures do not modify them in ways that could cause race conditions or memory corruption. Additionally, system administrators should ensure all systems are updated with the latest kernel patches, particularly those containing the specific fix for CVE-2024-57901, and monitor for any related kernel stability issues or unexpected crashes in network-intensive applications. The fix essentially transforms the function from a potentially destructive operation into a safe read-only protocol detection mechanism, thereby eliminating the race condition and memory corruption vulnerability that was present in the original implementation.