CVE-2024-50257

CVE Details

Release Date:

2024-11-09

Description

In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: Fix use-after-free in get_info()\nip6table_nat module unload has refcnt warning for UAF. call trace is:\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\nModules linked in: ip6table_nat(-)\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:module_put+0x6f/0x80\nCall Trace:\n\nget_info+0x128/0x180\ndo_ip6t_get_ctl+0x6a/0x430\nnf_getsockopt+0x46/0x80\nipv6_getsockopt+0xb9/0x100\nrawv6_getsockopt+0x42/0x190\ndo_sock_getsockopt+0xaa/0x180\n__sys_getsockopt+0x70/0xc0\n__x64_sys_getsockopt+0x20/0x30\ndo_syscall_64+0xa2/0x1a0\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nConcurrent execution of module unload and get_info() trigered the warning.\nThe root cause is as follows:\ncpu0 cpu1\nmodule_exit\n//mod->state = MODULE_STATE_GOING\nip6table_nat_exit\nxt_unregister_template\nkfree(t)\n//removed from templ_list\ngetinfo()\nt = xt_find_table_lock\nlist_for_each_entry(tmpl, &xt_templates[af]...)\nif (strcmp(tmpl->name, name))\ncontinue; //table not found\ntry_module_get\nlist_for_each_entry(t, &xt_net->tables[af]...)\nreturn t; //not get refcnt\nmodule_put(t->me) //uaf\nunregister_pernet_subsys\n//remove table from xt_net list\nWhile xt_table module was going away and has been removed from\nxt_templates list, we couldnt get refcnt of xt_table->me. Check\nmodule in xt_net->tables list re-traversal to fix it.

See more information about CVE-2024-50257 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.8
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality:	High
Integrity:	High
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12887	2024-12-18
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12887	2024-12-18