CVE-2024-50130: netfilter: bpf: must hold reference on net namespace
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: must hold reference on net namespace
BUG: KASAN: slab-use-after-free in nfunregisternethook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpfnflinkrelease+0xda/0x1e0 bpflinkfree+0x139/0x2d0 bpflinkrelease+0x68/0x80 fput+0x414/0xb60
Eric says: It seems that bpf was able to defer the nfunregisternethook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpfnflinkattach() does : link->net = net; But I do not see a reference being taken on net.
Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50130?
CVE-2024-50130 has been classified as a high-severity vulnerability due to the potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2024-50130?
To address CVE-2024-50130, users should upgrade their Linux kernel to a patched version above 6.6.59 for 6.4.x or above 6.11.6 for 6.7.x.
Which versions of the Linux kernel are affected by CVE-2024-50130?
CVE-2024-50130 affects Linux kernel versions between 6.4 and 6.6.59, as well as 6.7 to 6.11.6 and specific release candidates.
What are the potential impacts of CVE-2024-50130?
Exploitation of CVE-2024-50130 could lead to system crashes or arbitrary code execution due to the use-after-free error.
Is there a workaround for CVE-2024-50130?
There are no official workarounds for CVE-2024-50130; the only solution is to update to a secure kernel version.