Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-33621— ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于ipvlan模块在ipvlan_process_v{4,6}_outbound中使用skb->sk。

AI Predicted 5.5 Difficulty: Hard EPSS 0.27% · P18

Possible ATT&CK Techniques 1 AI

T1498.002 · Reflection Amplification

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 2ad7bf3638411cb547f2823df08166c13ab04269< 0049a623dfbbb49888de7f0c2f33a582b5ead989 affected
2ad7bf3638411cb547f2823df08166c13ab04269< 54768bacfde60e8e4757968d79f8726711dd2cf5 affected
2ad7bf3638411cb547f2823df08166c13ab04269< 1abbf079da59ef559d0ab4219d2a0302f7970761 affected
2ad7bf3638411cb547f2823df08166c13ab04269< 183c4b416454b9983dc1b8aa0022b748911adc48 affected
2ad7bf3638411cb547f2823df08166c13ab04269< cb53706a3403ba67f4040b2a82d9cf79e11b1a48 affected
2ad7bf3638411cb547f2823df08166c13ab04269< 54213c09801e0bd2549ac42961093be36f65a7d0 affected
2ad7bf3638411cb547f2823df08166c13ab04269< 13c4543db34e0da5a7d2f550b6262d860f248381 affected
2ad7bf3638411cb547f2823df08166c13ab04269< b3dc6e8003b500861fa307e9a3400c52e78e4d3a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-33621

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path. WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_mc_loop+0x2d/0x70 Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? __warn (kernel/panic.c:693) ? sk_mc_loop (net/core/sock.c:760) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:239) ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? sk_mc_loop (net/core/sock.c:760) ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) ? nf_hook_slow (net/netfilter/core.c:626) ip6_finish_output (net/ipv6/ip6_output.c:222) ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan dev_hard_start_xmit (net/core/dev.c:3594) sch_direct_xmit (net/sched/sch_generic.c:343) __qdisc_run (net/sched/sch_generic.c:416) net_tx_action (net/core/dev.c:5286) handle_softirqs (kernel/softirq.c:555) __irq_exit_rcu (kernel/softirq.c:589) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043) The warning triggers as this: packet_sendmsg packet_snd //skb->sk is packet sk __dev_queue_xmit __dev_xmit_skb //q->enqueue is not NULL __qdisc_run sch_direct_xmit dev_hard_start_xmit ipvlan_start_xmit ipvlan_xmit_mode_l3 //l3 mode ipvlan_process_outbound //vepa flag ipvlan_process_v6_outbound ip6_local_out __ip6_finish_output ip6_finish_output2 //multicast packet sk_mc_loop //sk->sk_family is AF_PACKET Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于ipvlan模块在ipvlan_process_v{4,6}_outbound中使用skb->sk。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 2ad7bf3638411cb547f2823df08166c13ab04269 ~ 0049a623dfbbb49888de7f0c2f33a582b5ead989 -
Linux Linux 3.19 -

II. Public POCs for CVE-2024-33621

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-33621

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-33621 (1)

Other References for CVE-2024-33621 (7)

Same Patch Batch · Linux · 2024-06-21 · 40 CVEs total

CVE-2024-36288 9.8 CRITICAL SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
CVE-2024-38381 8.8 HIGH nfc: nci: Fix uninit-value in nci_rx_work
CVE-2024-33619 7.8 HIGH efi: libstub: only free priv.runtime_map when allocated
CVE-2024-36477 7.8 HIGH tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
CVE-2024-38628 7.8 HIGH usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
CVE-2024-36286 7.8 HIGH netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
CVE-2024-38626 7.8 HIGH fuse: clear FR_SENT when re-adding requests into pending list
CVE-2024-38388 7.8 HIGH ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
CVE-2024-38623 7.8 HIGH fs/ntfs3: Use variable length array instead of fixed size
CVE-2024-38635 7.8 HIGH soundwire: cadence: fix invalid PDI offset
CVE-2024-38659 7.3 HIGH enic: Validate length of nl attributes in enic_set_vf_port
CVE-2024-38631 iio: adc: PAC1934: fix accessing out of bounds array index
CVE-2024-38625 fs/ntfs3: Check 'folio' pointer for NULL
CVE-2024-38632 vfio/pci: fix potential memory leak in vfio_intx_enable()
CVE-2024-38633 serial: max3100: Update uart_driver_registered on driver removal
CVE-2024-38634 serial: max3100: Lock port->lock when calling uart_handle_cts_change()
CVE-2024-38636 f2fs: multidev: fix to recognize valid zero block address
CVE-2024-38637 greybus: lights: check return of get_channel_from_mode
CVE-2024-38662 bpf: Allow delete from sockmap/sockhash only if update is allowed
CVE-2024-38780 dma-buf/sw-sync: don't enable IRQ from sync_print_obj()

Showing top 20 of 40 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-33621

No comments yet

Leave a comment