CVE-2024-35857

icmp: prevent possible NULL dereferences from icmp_build_probe()

State: Published
Severity: 7.5 High
Published: May 17, 2024
Updated: Aug 5, 2026
Reserved: May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

icmp: prevent possible NULL dereferences from icmp_build_probe()

First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL.

if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)

Second problem is a read from dev->ip6_ptr with no NULL check:

if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))

Use the correct RCU API to fix these.

v2: add missing include <net/addrconf.h>

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 23b7ee4a8d559bf38eac7ce5bb2f6ebf76f9c401Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 599c9ad5e1d43f5c12d869f5fd406ba5d8c55270Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before d68dc711d84fdcf698e5d45308c3ddeede586350Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 3e2979bf080c40da4f7c93aff8575ab8bc62b767Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before c58e88d49097bd12dfcfef4f075b43f5d5830941Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.158 through 5.15.Not affected 6.1.90 through 6.1.Not affected 6.6.30 through 6.6.Not affected 6.8.9 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 23b7ee4a8d559bf38eac7ce5bb2f6ebf76f9c401Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 599c9ad5e1d43f5c12d869f5fd406ba5d8c55270Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before d68dc711d84fdcf698e5d45308c3ddeede586350Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 3e2979bf080c40da4f7c93aff8575ab8bc62b767Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before c58e88d49097bd12dfcfef4f075b43f5d5830941Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.158 through 5.15.*Not affected
6.1.90 through 6.1.*Not affected
6.6.30 through 6.6.*Not affected
6.8.9 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.