CVE-2024-46800

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46800
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/14f91ab8d391f249b845916820a56f42cf747241 Patch
https://git.kernel.org/stable/c/295ad5afd9efc5f67b86c64fce28fb94e26dc4c9 Patch
https://git.kernel.org/stable/c/32008ab989ddcff1a485fa2b4906234c25dc5cd6 Patch
https://git.kernel.org/stable/c/3b3a2a9c6349e25a025d2330f479bc33a6ccb54a Patch
https://git.kernel.org/stable/c/98c75d76187944296068d685dfd8a1e9fd8c4fdc Patch
https://git.kernel.org/stable/c/db2c235682913a63054e741fe4e19645fdf2d68e Patch
https://git.kernel.org/stable/c/dde33a9d0b80aae0c69594d1f462515d7ff1cb3d Patch
https://git.kernel.org/stable/c/f0bddb4de043399f16d1969dad5ee5b984a64e7b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*
History

20 Sep 2024, 17:18

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-416
References () https://git.kernel.org/stable/c/14f91ab8d391f249b845916820a56f42cf747241 - () https://git.kernel.org/stable/c/14f91ab8d391f249b845916820a56f42cf747241 - Patch
References () https://git.kernel.org/stable/c/295ad5afd9efc5f67b86c64fce28fb94e26dc4c9 - () https://git.kernel.org/stable/c/295ad5afd9efc5f67b86c64fce28fb94e26dc4c9 - Patch
References () https://git.kernel.org/stable/c/32008ab989ddcff1a485fa2b4906234c25dc5cd6 - () https://git.kernel.org/stable/c/32008ab989ddcff1a485fa2b4906234c25dc5cd6 - Patch
References () https://git.kernel.org/stable/c/3b3a2a9c6349e25a025d2330f479bc33a6ccb54a - () https://git.kernel.org/stable/c/3b3a2a9c6349e25a025d2330f479bc33a6ccb54a - Patch
References () https://git.kernel.org/stable/c/98c75d76187944296068d685dfd8a1e9fd8c4fdc - () https://git.kernel.org/stable/c/98c75d76187944296068d685dfd8a1e9fd8c4fdc - Patch
References () https://git.kernel.org/stable/c/db2c235682913a63054e741fe4e19645fdf2d68e - () https://git.kernel.org/stable/c/db2c235682913a63054e741fe4e19645fdf2d68e - Patch
References () https://git.kernel.org/stable/c/dde33a9d0b80aae0c69594d1f462515d7ff1cb3d - () https://git.kernel.org/stable/c/dde33a9d0b80aae0c69594d1f462515d7ff1cb3d - Patch
References () https://git.kernel.org/stable/c/f0bddb4de043399f16d1969dad5ee5b984a64e7b - () https://git.kernel.org/stable/c/f0bddb4de043399f16d1969dad5ee5b984a64e7b - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*

20 Sep 2024, 12:30

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch/netem: se corrige el use after free en netem_dequeue si netem_dequeue() pone en cola el paquete en la qdisc interna y esa qdisc devuelve __NET_XMIT_STOLEN. El paquete se descarta pero no se llama a qdisc_tree_reduce_backlog() para actualizar el q.qlen del padre, lo que lleva a un use after free similar al Commit e04991a48dbaf382 ("netem: corrige el valor de retorno si falla la puesta en cola duplicada") Comandos para activar KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Desencadenador de error tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF

18 Sep 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-18 08:15

Updated : 2024-09-20 17:18

NVD link : CVE-2024-46800

Mitre link : CVE-2024-46800

CVE.ORG link : CVE-2024-46800

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free