CVE-2024-35962

What it actually does

Missing optlen validation before xt_alloc_table_info() allows unsafe copy_from_sockptr_offset() calls in netfilter do_replace() handlers, enabling local users to trigger invalid memory access resulting in kernel denial of service.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes leading to system instability, service outages, and potential data loss in availability-dependent environments; widespread use of the Linux kernel increases operational risk across servers and devices.

How an attack unfolds

An attacker with local access crafts malicious netfilter table replacement data with invalid sizes, bypassing incomplete validation to cause out-of-bounds behavior during copy operations in the kernel netfilter subsystem.

How to fix it

Upgrade the Linux kernel to version 5.10.216 or later, or apply the fix from commit cf4bc359b76144a3dd55d7c09464ef4c5f2b2b05 in the stable repository; ensure all affected branches receive the complete optlen validation patch before xt_alloc_table_info().

How to confirm the fix worked

Verify kernel version is 5.10.216 or newer; inspect netfilter code for the optlen check (u64)optlen < (u64)tmp.size + sizeof(tmp) prior to allocation; test with known malformed table inputs to confirm rejection with -EINVAL.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Prepare crafted netfilter table data with manipulated optlen values
3. Invoke do_replace() handlers via user-space netfilter interfaces
4. Trigger unsafe copy_from_sockptr_offset() leading to kernel panic

How to detect it

Review kernel logs for netfilter-related oops or panic entries around table replacement operations; look for repeated failed xt_alloc_table_info calls in audit or system logs; no specific threat actor activity tied to this issue has been observed.

What your security team should do

• Prioritize kernel upgrades on all production systems within standard maintenance windows given low EPSS and no KEV listing
• Monitor for local privilege abuse attempts against netfilter interfaces
• Apply the specific fixed commit or 5.10.216 across all distributions
• Review downstream dependent packages for kernel updates