CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of ICMP and NDISC Redirect messages, specifically when peer allocation fails due to memory constraints. This flaw can lead to an un-rate-limited storm of ICMP packets, potentially overwhelming network resources and causing denial-of-service conditions. System administrators and organizations utilizing Linux-based systems should prioritize addressing this issue to mitigate the risk of network disruption.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages. In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL. Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm. Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.