Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-35886— ipv6: Fix infinite recursion in fib6_dump_done().

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于存在无限递归。

AI Predicted 5.5 Difficulty: Hard EPSS 0.28% · P20

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 9472d07cd095cbd3294ac54c42f304a38fbe9bfe affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 9c5258196182c25b55c33167cd72fdd9bbf08985 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 40a344b2ddc06c1a2caa7208a43911f39c662778 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< f2dd75e57285f49e34af1a5b6cd8945c08243776 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4a7c465a5dcd657d59d25bf4815e19ac05c13061 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-35886

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: Fix infinite recursion in fib6_dump_done().
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0] 12:01:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, ... snip ...) recvmmsg(r0, ... snip ...) (fail_nth: 8) Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped receiving the response halfway through, and finally netlink_sock_destruct() called nlk_sk(sk)->cb.done(). fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it is still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling itself recursively and hitting the stack guard page. To avoid the issue, let's set the destructor after kzalloc(). [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue. ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于存在无限递归。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 9472d07cd095cbd3294ac54c42f304a38fbe9bfe -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2024-35886

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-35886

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-35886 (2)

Other References for CVE-2024-35886 (7)

Same Patch Batch · Linux · 2024-05-19 · 82 CVEs total

CVE-2024-35861 9.8 CRITICAL smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
CVE-2024-35862 9.8 CRITICAL smb: client: fix potential UAF in smb2_is_network_name_deleted()
CVE-2024-35863 9.8 CRITICAL smb: client: fix potential UAF in is_valid_oplock_break()
CVE-2024-35864 9.8 CRITICAL smb: client: fix potential UAF in smb2_is_valid_lease_break()
CVE-2024-35865 9.8 CRITICAL smb: client: fix potential UAF in smb2_is_valid_oplock_break()
CVE-2024-35884 9.8 CRITICAL udp: do not accept non-tunnel GSO skbs landing in a tunnel
CVE-2024-35870 9.8 CRITICAL smb: client: fix UAF in smb2_reconnect_server()
CVE-2024-35869 9.8 CRITICAL smb: client: guarantee refcounted children from parent session
CVE-2024-35939 9.3 CRITICAL dma-direct: Leak pages on dma_set_decrypted() failure
CVE-2024-35887 8.8 HIGH ax25: fix use-after-free bugs caused by ax25_ds_del_timer
CVE-2024-35915 8.8 HIGH nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
CVE-2024-35889 8.6 HIGH idpf: fix kernel panic on unknown packet types
CVE-2024-35875 8.4 HIGH x86/coco: Require seeding RNG with RDRAND on CoCo systems
CVE-2024-35937 8.1 HIGH wifi: cfg80211: check A-MSDU format more carefully
CVE-2024-35919 7.8 HIGH media: mediatek: vcodec: adding lock to protect encoder context list
CVE-2024-35931 7.8 HIGH drm/amdgpu: Skip do PCI error slot reset during RAS recovery
CVE-2024-35890 7.8 HIGH gro: fix ownership transfer
CVE-2024-35920 7.8 HIGH media: mediatek: vcodec: adding lock to protect decoder context list
CVE-2024-35921 7.8 HIGH media: mediatek: vcodec: Fix oops when HEVC init fails
CVE-2024-35897 7.8 HIGH netfilter: nf_tables: discard table flag update with pending basechain deletion

Showing top 20 of 82 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-35886

No comments yet

Leave a comment