CVE-2024-35857: Linux Kernel Use-After-Free Vulnerability

CVE-2024-35857 Overview

CVE-2024-35857 is a NULL pointer dereference vulnerability [CWE-476] in the Linux kernel's Internet Control Message Protocol (ICMP) subsystem. The flaw resides in the icmp_build_probe() function, where two unsafe code paths can dereference NULL pointers. The first issue involves a double call to __in_dev_get_rcu(), where the second invocation may return NULL. The second issue reads from dev->ip6_ptr without a NULL check. Remote attackers can trigger the flaw over the network to crash the kernel, resulting in denial of service.

Critical Impact
A remote, unauthenticated attacker can send crafted ICMP probe requests to trigger a NULL pointer dereference in the kernel, causing a system crash and denial of service on affected Linux hosts.

Affected Products

Linux Kernel 6.9-rc1
Linux Kernel 6.9-rc2 through 6.9-rc5
Earlier Linux kernel branches receiving stable backports (see kernel.org commits)

Discovery Timeline

2024-05-17 - CVE-2024-35857 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-35857

Vulnerability Analysis

The vulnerability exists in the kernel's ICMP handling code responsible for building ICMP probe responses. icmp_build_probe() processes ICMP Extended Echo Request messages (RFC 8335) used for interface probing. The function evaluates network device state to construct a reply, but the code paths in question use the Read-Copy-Update (RCU) API incorrectly.

The first defective pattern invokes __in_dev_get_rcu(dev) twice within the same conditional expression: if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list). Between the two calls, another CPU may unpublish the in_device pointer, causing the second call to return NULL and the subsequent ->ifa_list field access to dereference NULL.

The second defective pattern reads dev->ip6_ptr via rcu_dereference() without checking whether the returned pointer is NULL before accessing the addr_list field with list_empty(). Devices without IPv6 configuration have a NULL ip6_ptr, so the dereference faults.

Root Cause

The root cause is improper application of the RCU API to pointers that may be concurrently modified or unset. Both defects fall under [CWE-476] Null Pointer Dereference. The fix caches the results of __in_dev_get_rcu() and rcu_dereference(dev->ip6_ptr) into local variables and validates them for NULL before subsequent field access. The patch series also adds the missing <net/addrconf.h> include.

Attack Vector

Exploitation requires network reachability to the target host and the ability to send ICMP Extended Echo Request packets to an interface that lacks IPv4 address configuration or lacks IPv6 configuration. No authentication or user interaction is required. Successful triggering produces a kernel oops or panic, resulting in denial of service. The vulnerability does not permit code execution or information disclosure.

The vulnerability manifests in net/ipv4/icmp.c within the probe-response path. Refer to the upstream fix commits at Kernel Git Commit d68dc71 and Kernel Git Commit c58e88d for the exact source changes.

Detection Methods for CVE-2024-35857

Indicators of Compromise

Unexpected kernel oops or panic entries in dmesg or /var/log/kern.log referencing icmp_build_probe, __in_dev_get_rcu, or NULL pointer dereference in the IP stack.
Sudden host reboots or network stack failures following inbound ICMP Extended Echo Request traffic (ICMP type 42).
Unusual volumes of inbound ICMP type 42 packets directed at interfaces without configured IPv4 or IPv6 addresses.

Detection Strategies

Monitor kernel crash telemetry and correlate faulting instruction pointers with icmp_build_probe symbol addresses in the running kernel image.
Deploy network sensors or firewall logging to identify ICMP Extended Echo Request traffic patterns targeting production Linux hosts.
Compare installed kernel package versions against distribution security advisories referencing CVE-2024-35857.

Monitoring Recommendations

Enable kdump and centralized crash reporting to capture kernel oops details for post-incident analysis.
Ingest dmesg and journald kernel logs into a centralized data lake to alert on RIP addresses within the ICMP subsystem.
Track ICMP type 42 packet rates at network edges and internal segmentation points.

How to Mitigate CVE-2024-35857

Immediate Actions Required

Inventory Linux hosts running kernel 6.9-rc1 through 6.9-rc5 and stable branches that have not yet received the fix.
Apply the vendor-supplied kernel updates from your distribution as they become available.
Restrict inbound ICMP Extended Echo Request (type 42) traffic at perimeter and host firewalls where the feature is not required.

Patch Information

The upstream fix is available in five stable-tree commits: 23b7ee4, 3e2979b, 599c9ad, c58e88d, and d68dc71. Consult your distribution's security tracker for the specific package version containing the backport.

Workarounds

Block inbound ICMP type 42 (Extended Echo Request) using iptables or nftables rules on affected hosts.
Ensure interfaces exposed to untrusted networks have valid IPv4 and IPv6 configurations to avoid the NULL paths.
Disable ICMP probe responses at the network edge if operational monitoring does not depend on them.

bash

# Configuration example: block ICMP Extended Echo Request (type 42)
sudo iptables -A INPUT -p icmp --icmp-type 42 -j DROP
sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 160 -j DROP

# Verify installed kernel version against distribution advisory
uname -r