CVE-2024-41066 ibmvnic: Add tx check to prevent skb leak
A memory leak in the ibmvnic driver can cause TCP congestion control failures, leading to network timeouts and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41066?
CVE-2024-41066 is a high-severity denial of service vulnerability in Linux kernel, published on 29 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ibmvnic: Add tx check to prevent skb leak
Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consumer_index] = IBMVNIC_INVALID_MAP; consumer_index ++; Where variable data looks like this: free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3] consumer_index^ tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null]
The driver has checks to ensure that free_map[consumer_index] pointed to a valid index but there was no check to ensure that this index pointed to an unused/null skb address. So, if, by some chance, our free_map and tx_buff lists become out of sync then we were previously risking an skb memory leak. This could then cause tcp congestion control to stop sending packets, eventually leading to ETIMEDOUT.
Therefore, add a conditional to ensure that the skb address is null. If not then warn the user (because this is still a bug that should be patched) and free the old pointer to prevent memleak/tcp problems.
Weakness: CWE-401
Which versions are affected by CVE-2024-41066?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41066?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-41066 being exploited?
There is no known exploitation of CVE-2024-41066 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48993, BELL-CVE-2024-41066, DEBIAN-CVE-2024-41066, GHSA-j7w3-jhcq-frvr, ROOT-OS-DEBIAN-11-CVE-2024-41066, UBUNTU-CVE-2024-41066.