CVE-2024-26669
📋 TL;DR
A memory leak vulnerability in the Linux kernel's net/sched subsystem when using flower classifier chain templates. When a qdisc is deleted, the kernel fails to properly clean up chain template offload resources, causing kernel memory exhaustion over time. This affects systems using traffic control (tc) with flower classifier chain templates.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or potential kernel crashes.
Likely Case
Memory leak leading to gradual performance degradation and eventual system instability requiring reboot.
If Mitigated
Minimal impact if proper monitoring detects memory exhaustion early and triggers remediation.
🎯 Exploit Status
Reproduction script provided in CVE description. Requires CAP_NET_ADMIN or root privileges to execute tc commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel commits: 32f2a0afa95f, 9ed46144cff3, c04709b2cc99
Vendor Advisory: https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8
Restart Required: Yes
Instructions:
1. Update to patched kernel version from your distribution. 2. For custom kernels, apply commits 32f2a0afa95f, 9ed46144cff3, c04709b2cc99. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable flower chain templates
linuxAvoid using chain templates with flower classifier in traffic control configuration
# Do not use: tc chain add dev <interface> ingress proto ip chain <num> flower
Monitor kernel memory usage
linuxImplement monitoring for slab memory growth to detect potential exploitation
# Monitor slab memory: watch -n 60 'cat /proc/meminfo | grep -i slab'
# Check for memory leaks: slabtop -o
🧯 If You Can't Patch
- Restrict CAP_NET_ADMIN capabilities to trusted users only
- Implement strict monitoring of tc command usage and kernel memory consumption
🔍 How to Verify
Check if Vulnerable:
Check if kernel is affected by testing with reproduction script: # tc qdisc add dev <interface> clsact && tc chain add dev <interface> ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 && tc qdisc del dev <interface> && monitor slab memory for growthCheck Version:
# Check kernel version: uname -rVerify Fix Applied:
Apply patch and test with same reproduction script - memory should not leak after qdisc deletion📡 Detection & Monitoring
Log Indicators:
- Kernel oom-killer messages
- System logs showing memory pressure
- Audit logs of tc command execution by unauthorized users
Network Indicators:
- Unusual traffic control configuration changes
SIEM Query:
process.name='tc' AND command_line CONTAINS 'chain add' AND command_line CONTAINS 'flower'🔗 References
- https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8
- https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97
- https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01
- https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8
- https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97
- https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01
