CVE-2024-39490

ipv6: sr: fix missing sk_buff release in seg6_input_core

Medium · published July 10, 2024

CVSS v3.1
6.2
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix missing sk_buff release in seg6_input_core

The seg6_input() function is responsible for adding the SRH into a

packet, delegating the operation to the seg6_input_core(). This function

uses the skb_cow_head() to ensure that there is sufficient headroom in

the sk_buff for accommodating the link-layer header.

In the event that the skb_cow_header() function fails, the

seg6_input_core() catches the error but it does not release the sk_buff,

which will result in a memory leak.

This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due

to headroom too small after SRH push") and persists even after commit

7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"),

where the entire seg6_input() code was refactored to deal with netfilter

hooks.

The proposed patch addresses the identified memory leak by requiring the

seg6_input_core() function to release the sk_buff in the event that

skb_cow_head() fails.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Published
2024-07-10T07:14Z
EPSS history
Timeline
  • 10 JUL 07:14Z
    ipv6: sr: fix missing sk_buff release in seg6_input_core
    cvelistv5