SECUFOCUSNOW
Home›CVE index›CVE-2024-41040
Review reviewHigh

CVE-2024-41040

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls...

CVSS
7
EPSS
1.00%
59.5% percentile
CISA KEV
Not listed
Published
2024.07.30
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability1.00%
Technical severityCVSS 7

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= f07c548314776231f0d47d73ec6caa5b17e876e8 < b81a523d54ea689414f67c9fb81a5b917a41ed55, >= 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 < 2b4d68df3f57ea746c430941ba9c03d7d8b5a23f, >= 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 < 4e71b10a100861fb27d9c5755dfd68f615629fae, >= 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 < 799a34901b634008db4a7ece3900e2b971d4c932, >= 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 < ef472cc6693b16b202a916482df72f35d94bd69e, >= 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 < 26488172b0292bed837b95a006a3f3431d1898c3, >= 30822781c89943b6a3ed122324ceb37cea7042a3, >= 5.10.43 < 5.10.222, >= 5.12.10 < 5.13, >= 5.13, >= 5.13 < 5.15.163, >= 5.16 < 6.1.100, >= 6.2 < 6.6.41, >= 6.7 < 6.9.10
Fixed versions
5.10.222, 5.13, 5.15.163, 6.1.100, 6.6.41, 6.9.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416