CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug
In the Linux kernel, the following vulnerability has been resolved:
net: Fix icmp host relookup triggering iprtbug
arp link failure may trigger iprtbug while xfrm enabled, call trace is:
WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 iprtbug+0x14/0x20 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iprtbug+0x14/0x20 Call Trace: <IRQ> ipsendskb+0x14/0x40 icmpsend+0x42d/0x6a0 ipv4linkfailure+0xe2/0x1d0 arperrorreport+0x3c/0x50 neighinvalidate+0x8d/0x100 neightimerhandler+0x2e1/0x330 calltimerfn+0x21/0x120 runtimerbase.part.0+0x1c9/0x270 runtimersoftirq+0x4c/0x80 handlesoftirqs+0xac/0x280 irqexitrcu+0x62/0x80 sysvecapictimerinterrupt+0x77/0x90
The script below reproduces this scenario: ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \ dir out priority 0 ptype main flag localok icmp ip l a veth1 type veth ip a a 192.168.141.111/24 dev veth0 ip l s veth0 up ping 192.168.141.155 -c 1
icmproutelookup() create input routes for locally generated packets while xfrm relookup ICMP traffic.Then it will set input route (dst->out = iprtbug) to skb for DESTUNREACH.
For ICMP err triggered by locally generated packets, dst->dev of output route is loopback. Generally, xfrm relookup verification is not required on loopback interfaces (net.ipv4.conf.lo.disablexfrm = 1).
Skip icmp relookup for locally generated packets to fix it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56647?
The severity level of CVE-2024-56647 is currently classified as moderate.
How do I fix CVE-2024-56647?
To fix CVE-2024-56647, it is recommended to update the Linux kernel to a version that incorporates the patch, specifically versions newer than 6.12.5 or 6.13-rc1.
What software is affected by CVE-2024-56647?
CVE-2024-56647 affects multiple versions of the Linux kernel from version 2.6.25 up to 6.12.5, as well as 6.13-rc1.
What is the impact of CVE-2024-56647?
The impact of CVE-2024-56647 may result in a kernel warning indicating an IP routing bug, which could potentially affect network stability.
Who is responsible for addressing CVE-2024-56647?
The responsibility for addressing CVE-2024-56647 lies with the Linux kernel maintainers and those deploying affected versions.