CVE-2024-50045

A flaw was found in the br_netfilter module of the Linux kernel. An attacker sending specially crafted untagged traffic through a Virtual Extensible LAN (VxLAN) device could trigger a kernel panic. This occurs when the system attempts to process fragmented packets, leading to a NULL pointer dereference. Successful exploitation results in a denial of service, making the system unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerability requires the br_netfilter module to be loaded and net.bridge.bridge-nf-call-iptables to be set to 1. If VxLAN bridging with untagged traffic is not required, consider disabling the br_netfilter module or setting net.bridge.bridge-nf-call-iptables to 0.

To disable the br_netfilter module: Create a file /etc/modprobe.d/blacklist-br_netfilter.conf with the content: blacklist br_netfilter Then, regenerate the initramfs and reboot the system.

To set net.bridge.bridge-nf-call-iptables to 0: sysctl -w net.bridge.bridge-nf-call-iptables=0 To make this persistent across reboots, add net.bridge.bridge-nf-call-iptables = 0 to /etc/sysctl.conf or a new file in /etc/sysctl.d/. A system reboot or service reload may be required for changes to take full effect.