CVE-2024-35857

What it actually does

Double invocation of __in_dev_get_rcu() without proper NULL handling plus an unchecked dereference of dev->ip6_ptr inside icmp_build_probe() allow a NULL pointer dereference under RCU-protected network device state changes.

Why it matters to the business

Kernel panic or denial of service affecting network stack stability on systems running vulnerable Linux kernels; widespread exposure across servers, containers, and embedded devices increases operational risk until patched.

How an attack unfolds

An attacker triggers ICMP error or probe processing on an interface undergoing RCU-protected address list changes so that the second __in_dev_get_rcu() or the ip6_ptr read returns NULL, causing an immediate kernel crash.

How to fix it

Update the Linux kernel to a version containing commit 23b7ee4a8d559bf38eac7ce5bb2f6ebf76f9c401 (or later stable backport) and rebuild any distribution packages; apply vendor kernel updates as they become available.

How to confirm the fix worked

Confirm the presence of the fixing commit in the running kernel source tree or verify that the patched RCU accessors (__in_dev_get_rcu combined with proper ip6_ptr handling) are present in net/ipv4/icmp.c; recompile and boot-test the updated kernel.

Typical attack path

1. Identify a reachable host running a vulnerable kernel version
2. Send crafted ICMP messages or trigger network events that invoke icmp_build_probe()
3. Force concurrent RCU grace-period activity on the target network device
4. Trigger NULL dereference leading to kernel panic or oops

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or NULL pointer dereference traces referencing icmp_build_probe or __in_dev_get_rcu; correlate with network interface configuration changes or high ICMP traffic volumes.

What your security team should do

• Prioritize kernel updates on all externally reachable Linux systems within the next maintenance window
• Monitor vendor advisories for distribution-specific packages containing the fix
• Enable kernel panic logging and watchdog mechanisms to detect crashes quickly
• Review network exposure of systems that process high volumes of ICMP traffic