CVE-2024-56647

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-00077-g2e1b3cc9d7f7

Description A vulnerability in the Linux kernel has been resolved, which could trigger an ip rt bug when an arp link failure occurs while xfrm is enabled. The issue arises from the icmp route lookup function creating input routes for locally generated packets while xfrm relooks up ICMP traffic, and then setting the input route to skb for DESTUNREACH. This problem can be reproduced with a specific script that configures xfrm policies and generates ICMP traffic. Generally, xfrm relookup verification is not required on loopback interfaces.

Recommendations To resolve this issue, skip icmp relookup for locally generated packets by setting net.ipv4.conf.lo.disable xfrm = 1 on loopback interfaces. At the moment, there is no information about a newer version that contains a fix for this vulnerability.