Critical Vulnerability in Linux Kernel: Arp Queue Management Flaw
Summary
CVE-2024-35839: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities. This specific issue affects the netfilter bridge functionality, which is responsible for managing network packet filtering and bridging operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified within the netfilter bridge component. This flaw arises when an skb (socket buffer) is added to a neigh->arp_queue while waiting for an ARP reply. The original skb's skb->dev can differ from neigh's neigh->dev, especially during bridging operations. This discrepancy can lead to a situation where skb->dev is reset to nf_bridge->physindev, potentially causing a crash if the physindev is freed while still in use. The vulnerability can be exploited in scenarios involving network bridging, leading to system instability and crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the kernel updates as soon as they are available.
Conclusion
The CVE-2024-35839 vulnerability in the Linux kernel poses a significant risk to systems utilizing network bridging. Users are strongly encouraged to update their kernel to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35839 is a vulnerability in the Linux kernel related to improper management of ARP queues in network bridging, which can lead to system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to system crashes and instability, particularly in environments that utilize network bridging.
Yes, the vulnerability has been fixed in Linux kernel versions 6.1.76-1 for Debian 12 and 6.7.7-1 for Debian 13.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
