CVE-2024-35839

What it actually does

Use-after-free in nf_bridge_info structure: skb->dev can be reset to a freed physindev pointer during bridged DNAT ARP queuing, allowing dangling reference when neigh->arp_queue is processed.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems handling bridged traffic can cause service outages, data loss, or potential privilege escalation in virtualized or container environments with high network bridging usage.

How an attack unfolds

An attacker crafts network traffic that triggers bridging across veth interfaces with DNAT, causing an skb to be queued on a neighbor ARP entry whose device differs from the bridge; when the ARP reply arrives and the original device is freed, the stale physindev pointer is dereferenced leading to crash or controlled memory access.

How to fix it

Update the Linux kernel to a version containing commit 7ae19ee81ca56b13c50a78de6c47d5b8fdc9d97b or later stable releases that replace physindev with physinif and use dev_get_by_index_rcu for safe access.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the fixed versions; test by reproducing bridged DNAT ARP scenarios and confirming no crash occurs on neigh->arp_queue processing.

Typical attack path

1. Send bridged packets requiring ARP resolution across veth pairs with DNAT rules active
2. Trigger skb queuing onto neigh->arp_queue while physindev remains set
3. Force device teardown or neigh_flush_dev to free the original net_device
4. Induce neigh_update and __skb_dequeue to dereference the now-freed pointer via br_nf_pre_routing_finish_bridge_slow

How to detect it

Review kernel logs for oops/panic traces containing arp_process, neigh_update, __skb_dequeue, br_nf_dev_xmit, or br_nf_pre_routing_finish_bridge_slow; inspect for unexpected device reference errors during bridge ARP handling.

What your security team should do

• Prioritize kernel upgrades on all systems using netfilter bridging within the next maintenance window
• Monitor for kernel oops or panic logs involving br_nf and neigh_arp_queue functions
• Apply network segmentation to reduce exposure of bridge interfaces handling DNAT traffic until patched