CVE-2024-26663

What it actually does

Missing bearer type validation in tipc_nl_bearer_add allows tipc_udp_nl_bearer_add to be invoked for non-UDP bearers, causing tipc_udp_is_known_peer to dereference a null media_ptr and trigger a general protection fault.

Why it matters to the business

Systems running affected Linux kernels with TIPC enabled may experience kernel crashes triggered by local or remote netlink messages, resulting in denial of service and potential loss of availability for dependent services.

How an attack unfolds

An attacker sends a crafted netlink message via tipc_nl_bearer_add that includes the TIPC_NLA_BEARER_UDP_OPTS attribute while specifying a non-UDP bearer type; the missing check routes execution to tipc_udp_nl_bearer_add which assumes a UDP media object, leading to the fault in tipc_udp_is_known_peer.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 24ec8f0da93b8a9fba11600be8a90f0d73fb46f1 or later stable releases that include the type check before invoking tipc_udp_nl_bearer_add.

How to confirm the fix worked

Verify the presence of the bearer-type check in tipc_nl_bearer_add in the running kernel source or binary; test by attempting to add a non-UDP bearer with UDP options and confirm no fault occurs.

Typical attack path

1. Obtain local or network access to send netlink messages to the TIPC netlink family
2. Construct a NLMSG with tipc bearer add request containing UDP options but a non-UDP bearer name
3. Deliver the message through netlink unicast to trigger the call path
4. Cause the kernel to execute tipc_udp_is_known_peer on an incompatible bearer structure

How to detect it

Review kernel logs for general protection faults with RIP in tipc_udp_is_known_peer or call traces through tipc_udp_nl_bearer_add and tipc_nl_bearer_add; inspect netlink audit records for bearer-add operations carrying UDP options on non-UDP bearers.

What your security team should do

• Prioritize patching all Linux systems exposing TIPC netlink interfaces to the fixed commit
• Restrict unprivileged netlink access to TIPC families via capabilities or LSM policies until patched
• Monitor kernel logs for general protection faults referencing tipc_udp_is_known_peer