CVE-2024-50304

A flaw was found in the Linux kernel's IPv4 tunneling subsystem. A local user can trigger an improper lock validation condition during IP tunnel lookup operations when managing network links. This issue generates a suspicious lock warning that can result in a Denial of Service (DoS) on systems configured to panic on kernel warnings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip_tunnel kernel module from being automatically loaded if IPv4 tunneling features are not required:

1. Create a configuration file to disable the module:

echo "install ip_tunnel /bin/true" > /etc/modprobe.d/disable-ip_tunnel.conf
echo "blacklist ip_tunnel" >> /etc/modprobe.d/disable-ip_tunnel.conf

2. If the module is already loaded, unload it or restart the system:

modprobe -r ip_tunnel

Caveats: Disabling the ip_tunnel module prevents the use of IPv4 tunneling technologies such as GRE, SIT, and IPIP, which may affect networking setups, VPNs, or container network plugins relying on these protocols. A system reboot or network service reload will cause temporary network disruption and may be required if dependent modules are currently in use.