Input Validation Vulnerability in Linux Kernel's Networking Components

CVE-2024-49571

Summary

In the Linux kernel, an input validation vulnerability exists when handling proposal messages within the networking subsystem. Specifically, the fields iparea_offset and ipv6_prefixes_cnt, which are sourced from a remote client, cannot be fully trusted. If iparea_offset surpasses its maximum value, it could lead to accessing incorrect memory addresses, potentially causing a system crash. The recently implemented patch introduces checks for both iparea_offset and ipv6_prefixes_cnt prior to their usage, enhancing the robustness of the networking code against malicious proposals.

References