VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-35973

CVE-2024-35973

Description

In the Linux kernel, the following vulnerability has been resolved:

geneve: fix header validation in geneve[6]_xmit_skb

syzbot is able to trigger an uninit-value in geneve_xmit() [1]

Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol.

If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all.

If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected.

Add skb_vlan_inet_prepare() to perform a complete mac validation.

Use this in geneve for the moment, I suspect we need to adopt this more broadly.

v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest - Only call __vlan_get_protocol() for vlan types.

v2,v3 - Addressed Sabrina comments on v1 and v2

[1]

BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75

CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a geneve tunnel header validation bug can cause uninitialized memory access, potentially leading to information disclosure.

Vulnerability

Description

The vulnerability lies in the geneve_xmit_skb function within the Linux kernel's geneve tunneling driver. The issue arises because pskb_inet_may_pull() uses skb->protocol instead of the more robust skb_protocol(skb, true). When a VLAN tag is present (e.g., from an af_packet socket), skb->protocol may contain a VLAN type, causing the network header to point incorrectly and leaving the linear data region smaller than expected. This results in an uninitialized memory read (uninit-value) when the driver accesses header fields.

Exploitation

An attacker can trigger this vulnerability by sending a specially crafted packet through a raw socket (af_packet) with a VLAN tag. The packet is then transmitted via the geneve tunnel, where the flawed validation fails to properly handle the VLAN header. The attack requires local access to the system and the ability to send raw packets (i.e., CAP_NET_RAW), but no authentication is needed if such access is granted. The bug is reachable without any special privileges beyond network access.

Impact

Successful exploitation could lead to the disclosure of sensitive kernel memory contents (uninitialized data) in transmitted packets, potentially leaking cryptographic keys, passwords, or other confidential information. Additionally, the uninitialized value may cause kernel crashes (KMSAN bug reports), leading to denial of service. The vulnerability is rated with a CVSS v3 base score of 5.5 (Medium) due to its local attack vector and low complexity.

Mitigation

The fix introduces skb_vlan_inet_prepare(), which correctly handles VLAN tags by first stripping the VLAN header before performing protocol checks. This patch has been applied to the Linux kernel mainline and backported to stable releases. Users should update their kernel to a version containing the fix. The vulnerability also affects certain Siemens industrial products (e.g., SIMATIC S7-1500 TM MFP - GNU/Linux subsystem), and Siemens has released security advisories (SSA-265688) [1] recommending updates.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

97

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.