CVE-2024-44983

What it actually does

Missing validation of the VLAN header protocol field before flowtable lookup in nf_flow_offload_inet_hook allows access to uninitialized memory, resulting in KMSAN-detected uninit-value use during netfilter ingress processing.

Why it matters to the business

Linux-based network devices and servers may experience kernel instability or crashes under crafted traffic, leading to service disruption; high prevalence of the kernel increases exposure across infrastructure.

How an attack unfolds

Attackers craft packets with insufficient VLAN header data and send them toward systems performing netfilter flowtable offload; the unvalidated access in the inet hook triggers the uninitialized-value condition during hook execution.

How to fix it

Apply the upstream fix commit c05155cc455785916164aa5e1b4605a2ae946537 or equivalent stable kernel updates that add VLAN header validation before flowtable lookup.

How to confirm the fix worked

Confirm kernel source or binary contains the VLAN validation change in net/netfilter/nf_flow_table_inet.c; replay crafted VLAN packets in a test environment and verify absence of KMSAN reports.

Typical attack path

1. Craft network packets with malformed or truncated VLAN headers
2. Direct packets to ingress path on target Linux system
3. Trigger nf_ingress and nf_hook_slow paths
4. Reach nf_flow_offload_inet_hook without prior header validation
5. Access uninitialized protocol field causing memory corruption or crash

How to detect it

Search kernel logs and dmesg for KMSAN reports referencing nf_flow_offload_inet_hook and uninit-value; inspect netfilter hook traces during high-volume ingress traffic.

• nf_flow_offload_inet_hook+0x45a/0x5f0
• KMSAN: uninit-value
• nf_flow_table_inet.c:32

What your security team should do

• Prioritize kernel upgrades on all exposed Linux systems within the next maintenance window
• Enable KMSAN or similar sanitizers in test and staging kernels to catch similar issues
• Restrict untrusted ingress traffic until patches are deployed
• Review netfilter flowtable usage and consider disabling offload if upgrade is delayed