CVE-2024-46677

What it actually does

A NULL pointer is returned from gtp_encap_enable_socket when sockfd_lookup fails, but callers only check for error pointers and dereference the NULL, causing a kernel crash or memory corruption.

Why it matters to the business

Systems running affected Linux kernels or dependent container runtimes may experience unexpected crashes or denial of service in GTP networking code, leading to service interruptions and requiring restarts.

How an attack unfolds

An attacker with local or network access triggers sockfd_lookup failure in GTP encapsulation setup; the missing NULL check allows dereference that can be leveraged for denial of service or potentially further memory corruption.

How to fix it

Update Linux kernel to commit 620fe9809752fae91b4190e897b81ed9976dfb39 or later. For CRI-O update to versions 1.19.5, 1.20.6, 1.21.5, 1.22.2 or 1.23.1.

How to confirm the fix worked

Verify the applied kernel or CRI-O version matches a listed fixed release and confirm gtp_encap_enable_socket now returns an error pointer on sockfd_lookup failure.

Typical attack path

1. Identify systems using GTP encapsulation in the Linux kernel or CRI-O
2. Cause sockfd_lookup to fail through crafted socket or network conditions
3. Trigger gtp_encap_enable_socket call path that returns NULL
4. Force callers to dereference the NULL pointer resulting in kernel fault

How to detect it

Review kernel logs for oops or panic messages referencing gtp_encap_enable_socket or sockfd_lookup failures; check system crash dumps for NULL dereference in GTP paths.

What your security team should do

• Apply the listed kernel and CRI-O fixed versions immediately on all affected systems
• Prioritize patching environments using GTP or container networking
• Monitor for kernel oops or crashes involving GTP functions until patched