CyberSecBulletin
CVE-2024-35886NVD status: Modified

Linux: Uncontrolled Recursion

Published Updated By the CyberSecBulletin desk

CVE-2024-35886 is a high-severity uncontrolled recursion vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9472d07cd095cbd3294ac54c42f304a38fbe9bfe, 9c5258196182c25b55c33167cd72fdd9bbf08985, fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 9472d07cd095cbd3294ac54c42f304a38fbe9bfe or 9c5258196182c25b55c33167cd72fdd9bbf08985 or fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 or 40a344b2ddc06c1a2caa7208a43911f39c662778, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
  3. Update Linux Kernel to 4.19.312 or 5.4.274 or 5.10.215 or 5.15.154, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 9472d07cd095cbd3294ac54c42f304a38fbe9bfe; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 9c5258196182c25b55c33167cd72fdd9bbf08985; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 40a344b2ddc06c1a2caa7208a43911f39c662778; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, f2dd75e57285f49e34af1a5b6cd8945c08243776; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 4a7c465a5dcd657d59d25bf4815e19ac05c13061; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae; and 1 more ranges9472d07cd095cbd3294ac54c42f304a38fbe9bfe, 9c5258196182c25b55c33167cd72fdd9bbf08985, fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6, 40a344b2ddc06c1a2caa7208a43911f39c662778, 167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2, f2dd75e57285f49e34af1a5b6cd8945c08243776
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
LinuxLinux Kernel2.6.13 up to, but not including, 4.19.312; 4.20 up to, but not including, 5.4.274; 5.5 up to, but not including, 5.10.215; 5.11 up to, but not including, 5.15.154; 5.16 up to, but not including, 6.1.85; 6.2 up to, but not including, 6.6.26; 6.7 up to, but not including, 6.8.5; 2.6.12; and 1 more ranges4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0] 12:01:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, ... snip ...) recvmmsg(r0, ... snip ...) (fail_nth: 8) Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped receiving the response halfway through, and finally netlink_sock_destruct() called nlk_sk(sk)->cb.done(). fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it is still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling itself recursively and hitting the stack guard page. To avoid the issue, let's set the destructor after kzalloc(). [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue. ---truncated---

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How developers prevent this class of flaw

  • Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

More Uncontrolled Recursion vulnerabilities (CWE-674)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Uncontrolled Recursion vulnerabilities

Spotted an error? Tell us.