CVE-2024-46800

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1:...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 50612537e9ab29693122fab20fc1eed235054ffe < f0bddb4de043399f16d1969dad5ee5b984a64e7b, >= 50612537e9ab29693122fab20fc1eed235054ffe < 295ad5afd9efc5f67b86c64fce28fb94e26dc4c9, >= 50612537e9ab29693122fab20fc1eed235054ffe < 98c75d76187944296068d685dfd8a1e9fd8c4fdc, >= 50612537e9ab29693122fab20fc1eed235054ffe < 14f91ab8d391f249b845916820a56f42cf747241, >= 50612537e9ab29693122fab20fc1eed235054ffe < db2c235682913a63054e741fe4e19645fdf2d68e, >= 50612537e9ab29693122fab20fc1eed235054ffe < dde33a9d0b80aae0c69594d1f462515d7ff1cb3d, >= 50612537e9ab29693122fab20fc1eed235054ffe < 32008ab989ddcff1a485fa2b4906234c25dc5cd6, >= 50612537e9ab29693122fab20fc1eed235054ffe < 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a, >= 3.3, >= 3.3 < 4.19.322, >= 4.20 < 5.4.284, >= 5.5 < 5.10.226, >= 5.11 < 5.15.167, >= 5.16 < 6.1.110, >= 6.2 < 6.6.51, >= 6.7 < 6.10.10, 6.11

Fixed versions

4.19.322, 5.4.284, 5.10.226, 5.15.167, 6.1.110, 6.6.51, 6.10.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416