Tracker / CVE-2024-46800
CVE-2024-46800
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF
Prodotti e versioni affette
| linux | linux_kernel |
|---|---|
| linux | linux_kernel · 3.3 → 4.19.322 |
| linux | linux_kernel · 4.20 → 5.4.284 |
| linux | linux_kernel · 5.11 → 5.15.167 |
| linux | linux_kernel · 5.16 → 6.1.110 |
| linux | linux_kernel · 5.5 → 5.10.226 |
| linux | linux_kernel · 6.2 → 6.6.51 |
| linux | linux_kernel · 6.7 → 6.10.10 |