CVE-2024-35889: idpf: fix kernel panic on unknown packet types
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix kernel panic on unknown packet types
In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer handler. This is especially problematic if tcpdump is running when such a packet is received, i.e. it would cause a kernel panic.
Instead, call ethtypetrans for every single packet, even when the packet type is unknown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35889?
CVE-2024-35889 has been classified with a severity level that indicates it could lead to a kernel panic under specific conditions.
How do I fix CVE-2024-35889?
To fix CVE-2024-35889, update the Linux kernel to version 6.9-rc1, 6.9-rc2, or apply the recommended patched versions from your distribution.
Which Linux kernel versions are affected by CVE-2024-35889?
CVE-2024-35889 affects Linux kernel versions before 6.8.5 and specifically targets 6.9-rc1 and 6.9-rc2.
What is the impact of CVE-2024-35889 on Linux-based systems?
The impact of CVE-2024-35889 may lead to unexpected kernel crashes when unknown packet types are encountered.
Is there a known exploit for CVE-2024-35889?
As of now, there are no known exploits publicly disclosed for CVE-2024-35889.