CVE-2024-40993: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40993 affects the Linux kernel's netfilter ipset component. The vulnerability was discovered in the rcu_dereference_protected() functionality when destroying all sets in either the pernet exit phase or during the execution of a "destroy all sets command" from userspace. While the userspace command scenario was properly handled in ip_set_dereference() through the nfnetlink mutex check, the pernet exit phase case was not accounted for (Kernel Commit).

The vulnerability stems from an incomplete protection mechanism in the ip_set_dereference() function within the netfilter/ipset subsystem. The issue specifically relates to the RCU (Read-Copy-Update) dereference protection checks that were missing a condition for the pernet exit phase. The fix involves modifying the ip_set_dereference macro to include an additional check for the instance's deleted status ((inst)->is_deleted) in the rcu_dereference_protected() conditions (Kernel Commit).

The vulnerability could potentially lead to race conditions during namespace cleanup and garbage collection in the list:set type, as indicated by the fix reference to commit 4e7aaa6b82d6 (Kernel Commit).

The vulnerability was discovered through automated testing by syzkaller and kernel test robot, as evidenced by multiple reports (syzbot+b62c37cdd58103293a5a@syzkaller.appspotmail.com and syzbot+cfbe1da5fdfc39efc293@syzkaller.appspotmail.com) (Kernel Commit).

The vulnerability has been patched in various Linux kernel versions. The fix has been backported to multiple stable kernel branches including 6.1.x series. Users should update their kernel to versions containing the fix. For Debian systems, the fix is included in linux-6.1 version 6.1.119-1~deb11u1 (Debian LTS).