Linux Kernel up to 6.6.18/6.7.6 Netfilter dev_queue_xmit memory leak

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.6.18/6.7.6. This vulnerability affects the function dev_queue_xmit of the component Netfilter. Executing a manipulation can lead to memory leak. This vulnerability is registered as CVE-2024-26834. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.6.18/6.7.6 and classified as critical. This vulnerability affects the function dev_queue_xmit of the component Netfilter. The manipulation with an unknown input leads to a memory leak vulnerability. The CWE definition for the vulnerability is CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: release dst in case direct xmit path is used Direct xmit does not use it since it calls dev_queue_xmit() to send packets, hence it calls dst_release(). kmemleak reports: unreferenced object 0xffff88814f440900 (size 184): comm "softirq", pid 0, jiffies 4294951896 hex dump (first 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[............. 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P............. backtrace (crc cb2bf5d6): [] kmem_cache_alloc+0x286/0x340 [] dst_alloc+0x43/0xb0 [] rt_dst_alloc+0x2e/0x190 [] __mkroute_output+0x244/0x980 [] ip_route_output_flow+0xc0/0x160 [] nf_ip_route+0xf/0x30 [] nf_route+0x2d/0x60 [] nft_flow_route+0x171/0x6a0 [nft_flow_offload] [] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [] expr_call_ops_eval+0x53/0x330 [nf_tables] [] nft_do_chain+0x17c/0x840 [nf_tables] [] nft_do_chain_inet+0xa1/0x210 [nf_tables] [] nf_hook_slow+0x5b/0x160 [] ip_forward+0x8b6/0x9b0 [] ip_rcv+0x221/0x230 [] __netif_receive_skb_one_core+0xfe/0x110

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2024-26834 since 02/19/2024. The exploitation appears to be difficult. There are known technical details, but no exploit is available.

Upgrading to version 6.6.19, 6.7.7 or 6.8 eliminates this vulnerability. Applying the patch 13b57b5cd591/a6cafdb49a7b/9256ab9232e3/2d17cf10179a/8762785f459b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4
• 6.7.5
• 6.7.6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion