CVE-2024-47678
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, the order of rate limiting for ICMP messages has been changed. Previously, the host-wide limit was checked first, then the per-destination limit; now the per-destination limit is checked first, and the host-wide limit is checked and consumed later. This change aims to prevent side-channel attacks.
Risk Assessment
The risk associated with this vulnerability is the potential use of side channels to infer information about network traffic. The fix eliminates this by reordering the limits.
Recommendation
It is recommended to update the Linux kernel to a version containing this fix as soon as possible to protect the system against potential side-channel attacks.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1) host wide ratelimit (icmp_global_allow()) 2) Per destination ratelimit (inetpeer based) In order to avoid side-channels attacks, we need to apply the per destination check first. This patch makes the following change : 1) icmp_global_allow() checks if the host wide limit is reached. But credits are not yet consumed. This is deferred to 3) 2) The per destination limit is checked/updated. This might add a new node in inetpeer tree. 3) icmp_global_consume() consumes tokens if prior operations succeeded. This means that host wide ratelimit is still effective in keeping inetpeer tree small even under DDOS. As a bonus, I removed icmp_global.lock as the fast path can use a lock-free operation.