CVE-2024-45016: netem: fix return value if duplicate enqueue fails
In the Linux kernel, the following vulnerability has been resolved:
netem: fix return value if duplicate enqueue fails
There is a bug in netemenqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUGON in skbtosgvec") that can lead to a use-after-free.
This commit made netemenqueue() always return NETXMITSUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlennotify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR.
There are two ways for the bug happen:
- If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped.
In both cases NETXMITSUCCESS is returned even though no packets are enqueued at the netem qdisc.
The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NETXMITSUCCESS.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernel netemto a version that resolves this vulnerability.Patch 5845f706388a
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45016?
CVE-2024-45016 is classified as a medium severity vulnerability due to potential use-after-free conditions.
How do I fix CVE-2024-45016?
To remediate CVE-2024-45016, upgrade your Linux kernel to at least version 5.10.226-1 or 6.1.123-1.
Which Linux kernel versions are affected by CVE-2024-45016?
CVE-2024-45016 affects Linux kernel versions from 5.0 to 6.10.x, including several release candidate versions of 6.11.
What impact does CVE-2024-45016 have on my system?
CVE-2024-45016 can lead to memory corruption and potential system crashes due to use-after-free errors.
Is there a patch available for CVE-2024-45016?
Yes, patches for CVE-2024-45016 are available in the latest Debian linux packages and the Linux kernel stable releases.