CVE-2024-35884

What it actually does

The vulnerability allows GROed UDP packets lacking SKB_GSO_UDP_TUNNEL or CSUM bits to reach tunnel receive paths such as Geneve across network namespaces, resulting in incorrect header offset adjustments, malformed frag_list skbs, and subsequent failures in skb_segment or skb_fragment that trigger kernel crashes or packet corruption.

Why it matters to the business

Network-intensive Linux systems using UDP GRO forwarding or rx-gro-list with tunnels may suffer kernel panics, service outages, and data corruption, increasing downtime and operational recovery costs especially in virtualized or containerized environments.

How an attack unfolds

An attacker sends or forwards UDP packets that undergo GRO in the current namespace; when the packets enter a tunnel endpoint residing in a different namespace the udp_gro_receive lookup fails to reject them, allowing the geneve path to pull headers without adjusting frag_list offsets and causing skb_segment to misinterpret packet boundaries.

How to fix it

Update the Linux kernel to commit 3391b157780bbedf8ef9f202cbf10ee90bf6b0f8 or any later stable release that extends the udp_unexpected_gso checks; rebuild and reboot affected hosts, or temporarily disable rx-udp-gro-forwarding and rx-gro-list until patched.

How to confirm the fix worked

Confirm the running kernel contains commit 3391b157780bbedf8ef9f202cbf10ee90bf6b0f8; reproduce Geneve or similar tunnel traffic with GRO enabled and verify absence of skb_segment or skb_fragment crashes.

Typical attack path

1. Configure or observe rx-udp-gro-forwarding or rx-gro-list enabled on a system with cross-namespace tunnel endpoints
2. Inject or forward UDP packets that GRO aggregates but lack tunnel GSO flags
3. Route the aggregated packets into a tunnel stack such as Geneve
4. Trigger skb_segment or skb_fragment on the incorrectly adjusted frag_list
5. Induce kernel BUG_ON, crash, or corrupted packet delivery

How to detect it

Search kernel logs and dmesg for BUG_ON messages in skb_segment during UDP or Geneve processing; correlate with systems that have rx-udp-gro-forwarding enabled and cross-namespace tunnels.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit on all hosts using GRO with tunnels
• Temporarily disable rx-udp-gro-forwarding where patching cannot occur immediately
• Add kernel oops monitoring for skb_segment and udp_gro paths to detect attempted exploitation