CVE-2024-35969: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35969 addresses a race condition vulnerability in the Linux kernel's IPv6 subsystem, specifically between the ipv6_get_ifaddr and ipv6_del_addr functions. The vulnerability was discovered in May 2024 and affects the Linux kernel's IPv6 address management functionality (NVD).

The vulnerability occurs when ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, where hlist_for_each_entry_rcu can return an item removed from the list. While RCU prevents memory from being freed immediately, it doesn't guarantee the content's integrity. The race condition can lead to a use-after-free scenario when ipv6_del_addr removes an entry and drops all references, but ipv6_get_ifaddr attempts to increment the reference count of the already freed entry (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CISA-ADP).

The vulnerability can result in a use-after-free condition, potentially leading to system crashes or denial of service. This is evidenced by the warning messages showing refcount addition on zero and subsequent system trace information (Kernel Commit).

The vulnerability requires local access and can be triggered through the interaction between IPv6 address management functions. The exploit path involves a specific timing sequence where ipv6_del_addr is called in parallel with ipv6_get_ifaddr, leading to a race condition (Kernel Commit).

The vulnerability has been fixed by implementing a new function in6_ifa_hold_safe that safely handles reference counting, preventing the race condition. The fix has been incorporated into various Linux kernel versions through security updates (Red Hat Advisory).