CVE-2024-53042

What it actually does

The ip_tunnel_init_flow() function can be invoked without the RCU read lock held on certain code paths, triggering a suspicious RCU usage warning and potential list traversal outside a reader section in dev_get_by_index_rcu().

Why it matters to the business

Kernel stability issues during network tunnel setup may lead to warnings, crashes, or degraded network functionality on affected Linux systems, increasing operational risk for infrastructure relying on IP tunnels.

How an attack unfolds

An attacker with local privileges triggers tunnel creation or modification via netlink interfaces such as ipgre_newlink, reaching ip_tunnel_bind_dev without RCU protection and causing the kernel to hit the RCU warning or related instability.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.229 or apply the commit e2742758c9c85c84e077ede5f916479f724e11c2; rebuild and reboot with the patched kernel. For distributions, apply the corresponding stable updates.

How to confirm the fix worked

Confirm the running kernel version contains the fix, verify absence of the RCU warning in dmesg when performing tunnel operations, and ensure l3mdev_master_upper_ifindex_by_index is used in ip_tunnel_init_flow.

Typical attack path

1. Obtain local user access on a Linux system running an affected kernel
2. Invoke netlink commands to create or modify IP tunnels (e.g., ip tunnel add)
3. Trigger ip_tunnel_newlink -> ip_tunnel_bind_dev without RCU read lock held
4. Cause dev_get_by_index_rcu to traverse RCU-protected lists outside a reader section
5. Observe kernel warning or potential denial-of-service effects

How to detect it

Review kernel logs for RCU-list warnings mentioning dev_get_by_index_rcu or l3mdev_master_upper_ifindex_by_index_rcu during netlink tunnel operations; correlate with processes invoking ip or similar tunnel configuration tools.

What your security team should do

• Prioritize kernel upgrades on systems using IP tunnels within the next maintenance window
• Monitor for kernel RCU warnings related to ip_tunnel_bind_dev
• Restrict unprivileged netlink access where possible until patched
• Test patched kernels in staging environments before broad deployment