CVE-2024-50257: netfilter: Fix use-after-free in get_info()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: Fix use-after-free in getinfo()
ip6tablenat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 moduleput+0x6f/0x80 Modules linked in: ip6tablenat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:moduleput+0x6f/0x80 Call Trace: <TASK> getinfo+0x128/0x180 doip6tgetctl+0x6a/0x430 nfgetsockopt+0x46/0x80 ipv6getsockopt+0xb9/0x100 rawv6getsockopt+0x42/0x190 dosockgetsockopt+0xaa/0x180 sysgetsockopt+0x70/0xc0 x64sysgetsockopt+0x20/0x30 dosyscall64+0xa2/0x1a0 entrySYSCALL64afterhwframe+0x77/0x7f
Concurrent execution of module unload and getinfo() trigered the warning. The root cause is as follows:
cpu0 cpu1 moduleexit //mod->state = MODULESTATEGOING ip6tablenatexit xtunregistertemplate kfree(t) //removed from templlist getinfo() t = xtfindtablelock listforeachentry(tmpl, &xttemplates[af]...) if (strcmp(tmpl->name, name)) continue; //table not found trymoduleget listforeachentry(t, &xtnet->tables[af]...) return t; //not get refcnt moduleput(t->me) //uaf unregisterpernetsubsys //remove table from xtnet list
While xttable module was going away and has been removed from xttemplates list, we couldnt get refcnt of xttable->me. Check module in xtnet->tables list re-traversal to fix it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50257?
The severity of CVE-2024-50257 is classified as medium due to the potential for use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2024-50257?
To fix CVE-2024-50257, update your Linux kernel to a version that includes the security patch, such as versions 5.10.223-1, 6.1.123-1, or later.
Is CVE-2024-50257 present in all versions of the Linux kernel?
No, CVE-2024-50257 specifically affects certain versions of the Linux kernel within the ranges mentioned in the vulnerability report.
Does CVE-2024-50257 affect both IPv4 and IPv6?
CVE-2024-50257 is related to the IPv6 implementation in the Linux kernel, specifically affecting the ip6table_nat module.
What are the potential impacts of exploiting CVE-2024-50257?
Exploitation of CVE-2024-50257 could lead to critical system crashes or service disruptions due to the use-after-free vulnerability.