Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-50036

net: do not delay dst_entries_add() in dst_release()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • f88649721268999bdff09777847080a52004f691 to < 547087307bc19417b4f2bc85ba9664a3e8db5a6aaffected
  • f88649721268999bdff09777847080a52004f691 to < e3915f028b1f1c37e87542e5aadd33728c259d96affected
  • f88649721268999bdff09777847080a52004f691 to < a60db84f772fc3a906c6c4072f9207579c41166faffected
  • f88649721268999bdff09777847080a52004f691 to < eae7435b48ffc8e9be0ff9cfeae40af479a609ddaffected
  • f88649721268999bdff09777847080a52004f691 to < 3c7c918ec0aa3555372c5a57f18780b7a96c5cfcaffected
  • f88649721268999bdff09777847080a52004f691 to < ac888d58869bb99753e7652be19a151df9ecb35daffected
  • 86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41affected
  • 591b1e1bb40152e22cee757f493046a0ca946bf8affected
  • df90819dafcd6b97fc665f63a15752a570e227a2affected
  • 9a4fe697023dbe6c25caa1f8b2153af869a29bd2affected
  • 3.10.50 to < 3.11affected
  • 3.12.26 to < 3.13affected
  • 3.14.14 to < 3.15affected
  • 3.15.7 to < 3.16affected

Linux Linux

Default version status: affected

  • 3.16affected
  • 0 to < 3.16unaffected
  • 5.10.230 to ≤ 5.10.*unaffected
  • 5.15.172 to ≤ 5.15.*unaffected
  • 6.1.117 to ≤ 6.1.*unaffected
  • 6.6.57 to ≤ 6.6.*unaffected
  • 6.11.4 to ≤ 6.11.*unaffected
  • 6.12 to ≤ *unaffected

References