CVE-2024-42108
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's rswitch network driver. An attacker could potentially crash the system or execute arbitrary code by sending specially crafted network packets. Systems running affected Linux kernel versions with the rswitch driver enabled are vulnerable.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service or potential arbitrary code execution with kernel privileges, resulting in complete system compromise.
Likely Case
System crash or kernel panic causing denial of service, requiring system reboot to restore functionality.
If Mitigated
Minor performance impact from packet processing errors if exploitation attempts are blocked.
🎯 Exploit Status
The vulnerability is trivial to reproduce using KFENCE and triggers with basic network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing the fix commits listed in references
Vendor Advisory: https://git.kernel.org/stable/c/4a41bb9f2b402469d425a1c13359d3b3ea4e6403
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. For distributions: Apply security updates from your vendor. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable rswitch driver
linuxPrevent loading of the vulnerable rswitch network driver module
echo 'blacklist rswitch' >> /etc/modprobe.d/blacklist-rswitch.conf
rmmod rswitch
Network filtering
linuxBlock ARP and ICMP traffic to affected interfaces using firewall rules
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p arp -j DROP
🧯 If You Can't Patch
- Disable the rswitch driver if not required for system functionality
- Implement strict network segmentation to limit access to systems using rswitch driver
🔍 How to Verify
Check if Vulnerable:
Check if rswitch module is loaded: lsmod | grep rswitch. Check kernel version against affected versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated beyond fix commits. Confirm rswitch module loads without errors in dmesg.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/messages or dmesg
- KFENCE error reports related to use-after-free in rswitch_poll()
Network Indicators:
- Unusual ARP or ICMP traffic patterns to systems with rswitch interfaces
SIEM Query:
source="kernel" AND ("panic" OR "use-after-free" OR "rswitch")🔗 References
- https://git.kernel.org/stable/c/4a41bb9f2b402469d425a1c13359d3b3ea4e6403
- https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b
- https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67
- https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b
- https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67
