CVE-2024-56647

What it actually does

ICMP relookup for locally generated packets with xfrm enabled sets dst->out to ip_rt_bug on loopback interfaces during ARP link failures, triggering a kernel warning in ip_rt_bug.

Why it matters to the business

Kernel warnings and potential availability issues can occur on Linux systems using IPsec/xfrm policies when ARP failures happen for locally originated ICMP traffic, increasing operational noise and risk of disruption in affected network configurations.

How an attack unfolds

An attacker with local access or the ability to trigger ARP failures on a system with xfrm policies active can cause the kernel to hit the ip_rt_bug path via crafted network conditions or link failures, leading to warnings or DoS-like behavior.

How to fix it

Update the Linux kernel to a version containing commit 9545011e7b2a8fc0cbd6e387a09f12cd41d7d82f or later; apply vendor backports for stable releases and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the fix commit, test reproduction script no longer triggers ip_rt_bug warning, and confirm net.ipv4.conf.lo.disable_xfrm behavior remains unchanged.

Typical attack path

1. Configure xfrm policy allowing localok ICMP
2. Create virtual interfaces and assign addresses
3. Trigger ping or ICMP traffic to unreachable host
4. Induce ARP link failure to invoke ipv4_link_failure
5. Observe ip_rt_bug warning during __icmp_send path

How to detect it

Search kernel logs and dmesg for ip_rt_bug warnings combined with xfrm and ARP failure traces; review audit logs for unusual local ICMP generation under xfrm policies.

What your security team should do

• Prioritize patching kernel on systems with xfrm policies enabled
• Monitor for ip_rt_bug warnings in dmesg and kernel logs
• Review and test network configurations using IPsec before deployment