CVE-2024-35839: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35839 affects the Linux kernel's netfilter bridge functionality. The vulnerability was discovered in January 2024 and involves a potential crash condition in the bridge netfilter code when handling ARP replies. The issue occurs when an skb (socket buffer) is added to a neighbor's ARP queue while waiting for an ARP reply, where the original skb's device can differ from the neighbor's device (Kernel Git).

The vulnerability stems from a race condition where skb->dev can be reset back to nf_bridge->physindev and used without proper protection against the device being freed. This can occur specifically during bridging of DNAT'd packets between virtual ethernet interfaces, where the skb would be added to the bridge's ARP queue. The crash can happen in the call stack involving arp_process, neigh_update, and br_nf_pre_routing_finish_bridge_slow functions (Kernel Git).

When exploited, this vulnerability can lead to a system crash due to use-after-free conditions when accessing freed network device structures. This primarily affects systems using Linux kernel's bridge netfilter functionality (NVD).

The vulnerability requires specific networking conditions involving bridge netfilter and DNAT configurations. It can be triggered during normal network operations when processing ARP replies in bridged network setups (Kernel Git).

The issue has been fixed by replacing the direct device pointer (physindev) with an interface index (physinif) in the nf_bridge_info structure. The fix uses dev_get_by_index_rcu() to safely access the device, ensuring either a valid device reference is obtained or the packet is dropped (Red Hat).