PT-2024-33961 · Linux+5 · Linux Kernel+5
Eric Dumazet
+2
·
Published
2024-10-17
·
Updated
2026-02-21
·
CVE-2024-50130
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
A slab-use-after-free bug has been identified in the Linux kernel, specifically in the netfilter: bpf component. This issue arises when the
nf unregister net hook() function is deferred after exit/close time, potentially due to a missing reference on the net namespace. The bug can be triggered through the bpf nf link release() function, leading to a read of size 8 at a specific memory address. Eric's analysis suggests that the bpf nf link attach() function assigns link->net = net without taking a reference on the net namespace, which may cause the netns to be dismantled or freed prematurely.Recommendations:
To resolve this issue, update the Linux kernel to version 6.6.61 or later. As a temporary workaround, consider restricting the use of the
bpf nf link attach() function until a patch is available. Additionally, avoid using the link->net variable in the affected API endpoints until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu