CVE-2024-35886Uncontrolled Recursion in Linux

Severity
7.8HIGHNVD
OSV8.8OSV7.0OSV6.8OSV5.5
EPSS
0.0%
top 97.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 19
Latest updateJan 9

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0] 12:01:34 executing program 3: r

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

NVDlinux/linux_kernel2.6.134.19.312+8
Debianlinux/linux_kernel< 5.10.216-1+3
Ubuntulinux/linux_kernel< 5.4.0-189.209+4
CVEListV5linux/linux1da177e4c3f41524e886b7f1b8a0c1fc7321cac29472d07cd095cbd3294ac54c42f304a38fbe9bfe+8
debiandebian/linux< linux 6.1.85-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

🔴Vulnerability Details

23
OSV
linux-azure, linux-azure-4.15 vulnerabilities2025-01-09
OSV
linux, linux-lts-xenial vulnerabilities2025-01-06
OSV
linux-aws, linux-kvm vulnerabilities2025-01-06
OSV
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities2025-01-06
OSV
linux-xilinx-zynqmp vulnerabilities2024-09-18

📋Vendor Advisories

23
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel vulnerabilities2025-01-06
Ubuntu
Linux kernel vulnerabilities2025-01-06
Ubuntu
Linux kernel vulnerabilities2025-01-06
Ubuntu
Linux kernel vulnerabilities2024-09-18

💬Community

1
Bugzilla
CVE-2024-35886 kernel: ipv6: Fix infinite recursion in fib6_dump_done().2024-05-20