CVE-2024-46800: sch/netem: fix use after free in netem_dequeue
In the Linux kernel, the following vulnerability has been resolved:
sch/netem: fix use after free in netemdequeue
If netemdequeue() enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails")
Commands to trigger KASAN UaF:
ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernel sch/netem: fix use after free in netem_dequeue (builds on/mentions Commit e04991a48dbaf382 "netem: fix return value if duplicate enqueue fails")to a version that resolves this vulnerability.Patch e04991a48dbaf382
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46800?
CVE-2024-46800 has been assigned a severity rating which indicates a significant risk associated with a use after free vulnerability in the Linux kernel.
How do I fix CVE-2024-46800?
To remediate CVE-2024-46800, it is necessary to upgrade the Linux kernel to a patched version that includes the fix for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-46800?
CVE-2024-46800 affects various versions of the Linux kernel prior to the fixed versions listed by the relevant vendor.
Is CVE-2024-46800 exploitable remotely?
CVE-2024-46800 could potentially be exploitable remotely depending on the specific configurations and use cases of the affected kernel.
What components are impacted by CVE-2024-46800?
CVE-2024-46800 specifically affects the sch/netem component of the Linux kernel related to packet scheduling.