CVE-2024-46677 - Linux Kernel GTP NULL Pointer Dereference

In late May 2024, Linux kernel maintainers patched a subtle but potentially dangerous vulnerability in the GTP (GPRS Tunneling Protocol) code. Tracked as CVE-2024-46677, this bug allowed for a NULL pointer dereference due to improper error handling with sockets in the kernel GTP module. Below, we break down what happened, how attackers could exploit it, and why this seemingly simple mistake was important to fix.

What Is the GTP Module & Why Does It Matter?

GTP is core to cellular networking; it tunnels data over IP networks, linking mobile devices to the internet. In Linux, enabling or managing GTP requires working with sockets (network connections).

The Vulnerability: NULL Not Checked Properly

The vulnerability existed in the way the kernel handled errors when looking up socket file descriptors in the GTP module. Here’s what went wrong:

Or NULL

- The GTP code (gtp_encap_enable_socket()) _only checked for error pointers_, and failed to handle the NULL case.
- But, if sockfd_lookup() failed and returned NULL, the code would proceed, later causing a NULL pointer dereference (kernel panic or worse).

In practice, this meant that a local attacker could trigger a kernel crash by passing an invalid socket fd under certain conditions, impacting system stability.

Code: Vulnerable Vs. Patched

Let’s look at the vulnerable function, before and after the fix.

Vulnerable Code (before patch)

static struct socket *gtp_encap_enable_socket(int fd)
{
    struct socket *sock;

    sock = sockfd_lookup(fd, &err);
    // Only checked for error pointers, NOT NULL
    if (IS_ERR(sock))
        return sock;
    // ... uses sock, but sock could be NULL!
    ...
}

Patched Code (after fix)

static struct socket *gtp_encap_enable_socket(int fd)
{
    struct socket *sock;

    sock = sockfd_lookup(fd, &err);
    if (!sock)
        return ERR_PTR(err);    // Return error pointer on NULL
    
    // Still check for normal error pointer:
    if (IS_ERR(sock))
        return sock;
    // Now, 'sock' is always valid or error!
    ...
}

Simply put:
Before: Only error-pointer checked → NULL could slip by.
After: Now returns error on NULL, making callers always check correctly for errors.

Exploitation: How Could This Be Used?

This vulnerability is not directly exploitable for privilege escalation, but it is a local Denial-of-Service (DoS). Here’s how an attacker could exploit it:

1. Prepare: Gain the ability to call or interact with the GTP kernel module (needs capability, often root or CAP_NET_ADMIN).

Trigger: Call GTP setup with an invalid socket fd, triggering sockfd_lookup() to return NULL.

3. Crash: When the kernel mistakenly tries to use a NULL pointer as a socket, it will dereference NULL, leading to a kernel OOPS or panic (system crash).

This could be abused in hosting environments or environments with untrusted container workloads where GTP is enabled and accessible.

Proof-of-Concept Exploitation

Here’s a hypothetical C code snippet illustrating how a local user might crash the kernel with this bug:

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>

// You'll need privileges to exploit this!
int main() {
    int bogus_fd = -42;  // Invalid file descriptor
    // Assuming gtp module exposes an ioctl or netlink triggering gtp_encap_enable_socket
    // This will cause 'sockfd_lookup' to return NULL older kernels.
    int ret = ioctl(bogus_fd, /* GTP_SPECIFIC_IOCTL_CODE */, NULL);
    printf("Trigger sent, returned: %d\n", ret);
    return ;
}

// This is a simplified view - actual exploit depends on kernel config & GTP API exposed

*Note:* You shouldn’t crash systems for fun — only test responsibly.

Main Linux commit fixing CVE-2024-46677:

net: gtp: fix a potential NULL pointer dereference (kernel.org)

CVE Record:

CVE-2024-46677 (NVD)

Discussion in Linux Kernel Mailing List:

LKML Patch Archive

Conclusion

CVE-2024-46677 demonstrates how small coding oversights can have big stability impacts in critical infrastructure like the Linux kernel. While this bug doesn’t directly lead to privilege escalation, it does allow for local denial of service on affected systems, especially wherever GTP is in use.

Keep your systems patched and always check for both error pointers and NULL values when handling error-prone kernel code!

Exclusive disclaimer: This article is written in plain language to help sysadmins and security researchers understand real-world kernel vulnerabilities. Use responsibly and always follow best practices.

Timeline

Published on: 09/13/2024 06:15:12 UTC
Last modified on: 09/15/2024 17:57:26 UTC