CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe()
In the Linux kernel, the following vulnerability has been resolved:
icmp: prevent possible NULL dereferences from icmpbuildprobe()
First problem is a double call to indevgetrcu(), because the second one could return NULL.
if (indevgetrcu(dev) && indevgetrcu(dev)->ifalist)
Second problem is a read from dev->ip6ptr with no NULL check:
if (!listempty(&rcudereference(dev->ip6ptr)->addrlist))
Use the correct RCU API to fix these.
v2: add missing include <net/addrconf.h>
Other sources
In the Linux kernel, the following vulnerability has been resolved:
icmp: prevent possible NULL dereferences from icmpbuildprobe()
The Linux kernel CVE team has assigned CVE-2024-35857 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051741-CVE-2024-35857-837c@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.158 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.90 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.30 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35857?
CVE-2024-35857 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35857?
To mitigate CVE-2024-35857, you should update to the kernel versions 5.15.158, 6.1.90, 6.6.30, 6.8.9, or 6.9 as recommended.
What software is affected by CVE-2024-35857?
CVE-2024-35857 affects specific kernel versions in Red Hat and Debian distributions.
Can CVE-2024-35857 lead to system crashes?
Yes, CVE-2024-35857 has the potential to cause NULL dereferences, which could lead to system instability or crashes.
When was CVE-2024-35857 disclosed?
CVE-2024-35857 was disclosed alongside the related kernel vulnerability fixes.