CVE-2024-50127: net: sched: fix use-after-free in taprio_change()
In the Linux kernel, the following vulnerability has been resolved:
net: sched: fix use-after-free in tapriochange()
In 'tapriochange()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched()', and critical section protected by 'q->currententrylock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcureplacepointer()' over 'rcuassignpointer()' to update 'admin' immediately before an attempt to schedule freeing.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: sched: fix use-after-free in tapriochange()
In 'tapriochange()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched()', and critical section protected by 'q->currententrylock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcureplacepointer()' over 'rcuassignpointer()' to update 'admin' immediately before an attempt to schedule freeing.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In taprio_change(), update the 'admin' pointer using rcu_replace_pointer() instead of rcu_assign_pointer() immediately before any attempt to schedule freeing, to avoid the use-after-free scenario described for net: sched: fix use-after-free in taprio_change().
Linux kernel (net: sched: taprio_change) admin pointer update (use rcu_replace_pointer instead of rcu_assign_pointer) = prefer rcu_replace_pointer() over rcu_assign_pointer()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50127?
CVE-2024-50127 has been classified with a high severity due to the use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2024-50127?
To fix CVE-2024-50127, update your Linux kernel to a version that has patched the vulnerability, specifically versions beyond those specified in the affected software list.
What software is affected by CVE-2024-50127?
CVE-2024-50127 affects multiple versions of the Linux kernel ranging from 5.2 to up to pre-release versions of 6.12 as specified in the vulnerability details.
What impact does CVE-2024-50127 have on systems?
CVE-2024-50127 can lead to potential remote exploitation, system crashes, or execution of arbitrary code due to the use-after-free condition.
Is there any workaround for CVE-2024-50127?
Currently, there are no recommended workarounds for CVE-2024-50127; upgrading to a patched kernel version is the advised course of action.