CVE-2024-26921

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

inet: inet_defrag: prevent sk release while still in use

ip_local_out() and other functions can pass skb->sk as function argument.

If the skb is a fragment and reassembly happens before such function call

returns, the sk must not be released.

This affects skb fragments reassembled via netfilter or similar

modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.

Eric Dumazet made an initial analysis of this bug. Quoting Eric:

Calling ip_defrag() in output path is also implying skb_orphan(),

which is buggy because output path relies on sk not disappearing.

A relevant old patch about the issue was :

8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")

[..]

net/ipv4/ip_output.c depends on skb->sk being set, and probably to an

inet socket, not an arbitrary one.

If we orphan the packet in ipvlan, then downstream things like FQ

packet scheduler will not work properly.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References