CVE-2024-35973 – A vulnerability in the Linux kernel's GENEVE (G... (How to Fix)

Q: What is the severity of CVE-2024-35973?

CVE-2024-35973 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) implementation allows uninitialized memory access when processing VLAN-tagged packets. This can lead to kernel memory corruption and potential denial of service or information disclosure. Systems using GENEVE tunnels with VLAN tagging are affected.

📋 TL;DR

A vulnerability in the Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) implementation allows uninitialized memory access when processing VLAN-tagged packets. This can lead to kernel memory corruption and potential denial of service or information disclosure. Systems using GENEVE tunnels with VLAN tagging are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when GENEVE tunneling is configured and VLAN-tagged packets are processed. Not all Linux systems use GENEVE by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential information disclosure from kernel memory, or remote code execution in kernel context.

🟠

Likely Case

System instability, kernel crashes, or denial of service affecting network connectivity through GENEVE tunnels.

🟢

If Mitigated

Minimal impact if VLAN tagging is not used with GENEVE tunnels or if proper network segmentation isolates vulnerable systems.

🌐 Internet-Facing: MEDIUM - Requires GENEVE tunnel endpoints to be internet-accessible and VLAN tagging to be used.

🏢 Internal Only: MEDIUM - Internal systems using GENEVE with VLAN tagging could experience crashes or instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted VLAN-tagged packets to GENEVE tunnel endpoints. The syzbot report shows proof-of-concept triggering uninitialized memory access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 10204df9beda4978bd1d0c2db0d8375bfb03b915, 190d9efa5773f26d6f334b1b8be282c4fa13fd5e, 357163fff3a6e48fe74745425a32071ec9caf852, 3c1ae6de74e3d2d6333d29a2d3e13e6094596c79, 43be590456e1f3566054ce78ae2dbb68cbe1a536

Vendor Advisory: https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable GENEVE tunneling

linux

Remove or disable GENEVE tunnel configurations if not required

ip link delete geneve0
modprobe -r geneve

Block VLAN-tagged packets to GENEVE

linux

Use firewall rules to drop VLAN-tagged packets destined for GENEVE ports

iptables -A INPUT -p udp --dport 6081 -m vlan -j DROP

🧯 If You Can't Patch

Isolate systems using GENEVE tunnels from untrusted networks
Implement network monitoring for abnormal GENEVE traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if GENEVE module is loaded: lsmod | grep geneve && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or is newer than vulnerable versions

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
OOM killer messages
Network interface errors

Network Indicators:

Abnormal UDP traffic on port 6081 with VLAN tags
GENEVE tunnel disruption

SIEM Query:

source="kernel" AND ("panic" OR "BUG" OR "geneve")

📊 Metadata

CVE ID: CVE-2024-35973

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

Published: May 20, 2024

Last Updated: April 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35973, you might also want to check these: