CVE-2024-46800

CVE Details

Release Date:2024-09-18

Description


In the Linux kernel, the following vulnerability has been resolved:\nsch/netem: fix use after free in netem_dequeue\nIf netem_dequeue() enqueues packet to inner qdisc and that qdisc\nreturns __NET_XMIT_STOLEN. The packet is dropped but\nqdisc_tree_reduce_backlog() is not called to update the parent's\nq.qlen, leading to the similar use-after-free as Commit\ne04991a48dbaf382 ('netem: fix return value if duplicate enqueue\nfails')\nCommands to trigger KASAN UaF:\nip link add type dummy\nip link set lo up\nip link set dummy0 up\ntc qdisc add dev lo parent root handle 1: drr\ntc filter add dev lo parent 1: basic classid 1:1\ntc class add dev lo classid 1:1 drr\ntc qdisc add dev lo parent 1:1 handle 2: netem\ntc qdisc add dev lo parent 2: handle 3: drr\ntc filter add dev lo parent 3: basic classid 3:1 action mirred egress\nredirect dev dummy0\ntc class add dev lo classid 3:1 drr\nping -c1 -W0.01 localhost # Trigger bug\ntc class del dev lo classid 1:1\ntc class add dev lo classid 1:1 drr\nping -c1 -W0.01 localhost # UaF

See more information about CVE-2024-46800 from MITRE CVE dictionary and NIST NVD


NOTE: The following CVSS metrics and score provided are preliminary and subject to review.


CVSS v3 metrics

Base Score: 6.6
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Version: 3.1
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: High

Errata information


PlatformErrataRelease Date
Oracle Linux version 7 (kernel-uek)ELSA-2024-128132024-11-12
Oracle Linux version 7 (kernel-uek)ELSA-2024-128682024-12-06
Oracle Linux version 8 (kernel-uek)ELSA-2024-128132024-11-12
Oracle Linux version 8 (kernel-uek)ELSA-2024-128152024-11-11
Oracle Linux version 9 (kernel-uek)ELSA-2024-128152024-11-11


This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:

software.hardware.complete