CVE-2024-35886: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35886 is a vulnerability in the Linux kernel's IPv6 implementation that causes infinite recursive calls of fib6_dump_done() during netlink socket destruction. The issue was discovered and reported by syzkaller, and was first disclosed on May 19, 2024 (NVD).

The vulnerability occurs when an AF_UNSPEC RTM_GETROUTE message is sent and the response is generated. During the dump process for IPv6, the first call of inet6_dump_fib() fails at kzalloc() due to fault injection. The issue arises because fib6_dump_done() is set to nlk_sk(sk)->cb.done, and subsequent calls set it to nlk_sk(sk)->cb.args[3]. When netlink_sock_destruct() calls nlk_sk(sk)->cb.done(), fib6_dump_done() calls fib6_dump_end() which rewrites nlk_sk(sk)->cb.done() with nlk_sk(sk)->cb.args[3], creating an infinite recursive loop that eventually hits the stack guard page (Kernel Commit).

The vulnerability results in a denial of service condition when triggered, as the infinite recursion eventually hits the stack guard page and crashes the system (NVD).

The vulnerability can be triggered through netlink socket operations, specifically by sending an AF_UNSPEC RTM_GETROUTE message and manipulating the response handling process. The issue has been demonstrated using the syzkaller kernel fuzzer (Kernel Commit).

The vulnerability has been fixed by modifying the order of operations in inet6_dump_fib(), specifically by setting the destructor after kzalloc(). The fix has been incorporated into various Linux distributions including Ubuntu and Debian through security updates (Ubuntu Notice, Debian Notice).