cve-2024-50257
Vulnerability from cvelistv5
Published
2024-11-09 10:15
Modified
2024-12-19 09:36
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: Fix use-after-free in get_info()
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80
Modules linked in: ip6table_nat(-)
CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:module_put+0x6f/0x80
Call Trace:
<TASK>
get_info+0x128/0x180
do_ip6t_get_ctl+0x6a/0x430
nf_getsockopt+0x46/0x80
ipv6_getsockopt+0xb9/0x100
rawv6_getsockopt+0x42/0x190
do_sock_getsockopt+0xaa/0x180
__sys_getsockopt+0x70/0xc0
__x64_sys_getsockopt+0x20/0x30
do_syscall_64+0xa2/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning.
The root cause is as follows:
cpu0 cpu1
module_exit
//mod->state = MODULE_STATE_GOING
ip6table_nat_exit
xt_unregister_template
kfree(t)
//removed from templ_list
getinfo()
t = xt_find_table_lock
list_for_each_entry(tmpl, &xt_templates[af]...)
if (strcmp(tmpl->name, name))
continue; //table not found
try_module_get
list_for_each_entry(t, &xt_net->tables[af]...)
return t; //not get refcnt
module_put(t->me) //uaf
unregister_pernet_subsys
//remove table from xt_net list
While xt_table module was going away and has been removed from
xt_templates list, we couldnt get refcnt of xt_table->me. Check
module in xt_net->tables list re-traversal to fix it.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 |
||||||
|
|||||||||
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-50257", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:25:40.458302Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-416", description: "CWE-416 Use After Free", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-11T14:58:32.580Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/netfilter/x_tables.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "ba22ea01348384df19cc1fabc7964be6e7189749", status: "affected", version: "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", versionType: "git", }, { lessThan: "cb7c388b5967946f097afdb759b7c860305f2d96", status: "affected", version: "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", versionType: "git", }, { lessThan: "6a1f088f9807f5166f58902d26246d0b88da03a8", status: "affected", version: "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", versionType: "git", }, { lessThan: "bab3bb35c03b263c486833d50d50c081d9e9832b", status: "affected", version: "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", versionType: "git", }, { lessThan: "f48d258f0ac540f00fa617dac496c4c18b5dc2fa", status: "affected", version: "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/netfilter/x_tables.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.15", }, { lessThan: "5.15", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.171", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.116", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.60", versionType: "semver", }, { lessThanOrEqual: "6.11.*", status: "unaffected", version: "6.11.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.12", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: Fix use-after-free in get_info()\n\nip6table_nat module unload has refcnt warning for UAF. call trace is:\n\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\nModules linked in: ip6table_nat(-)\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:module_put+0x6f/0x80\nCall Trace:\n <TASK>\n get_info+0x128/0x180\n do_ip6t_get_ctl+0x6a/0x430\n nf_getsockopt+0x46/0x80\n ipv6_getsockopt+0xb9/0x100\n rawv6_getsockopt+0x42/0x190\n do_sock_getsockopt+0xaa/0x180\n __sys_getsockopt+0x70/0xc0\n __x64_sys_getsockopt+0x20/0x30\n do_syscall_64+0xa2/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nConcurrent execution of module unload and get_info() trigered the warning.\nThe root cause is as follows:\n\ncpu0\t\t\t\t cpu1\nmodule_exit\n//mod->state = MODULE_STATE_GOING\n ip6table_nat_exit\n xt_unregister_template\n\tkfree(t)\n\t//removed from templ_list\n\t\t\t\t getinfo()\n\t\t\t\t\t t = xt_find_table_lock\n\t\t\t\t\t\tlist_for_each_entry(tmpl, &xt_templates[af]...)\n\t\t\t\t\t\t\tif (strcmp(tmpl->name, name))\n\t\t\t\t\t\t\t\tcontinue; //table not found\n\t\t\t\t\t\t\ttry_module_get\n\t\t\t\t\t\tlist_for_each_entry(t, &xt_net->tables[af]...)\n\t\t\t\t\t\t\treturn t; //not get refcnt\n\t\t\t\t\t module_put(t->me) //uaf\n unregister_pernet_subsys\n //remove table from xt_net list\n\nWhile xt_table module was going away and has been removed from\nxt_templates list, we couldnt get refcnt of xt_table->me. Check\nmodule in xt_net->tables list re-traversal to fix it.", }, ], providerMetadata: { dateUpdated: "2024-12-19T09:36:41.886Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749", }, { url: "https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96", }, { url: "https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8", }, { url: "https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b", }, { url: "https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa", }, ], title: "netfilter: Fix use-after-free in get_info()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-50257", datePublished: "2024-11-09T10:15:10.373Z", dateReserved: "2024-10-21T19:36:19.980Z", dateUpdated: "2024-12-19T09:36:41.886Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2024-50257\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:11.340\",\"lastModified\":\"2024-12-11T15:15:13.913\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: Fix use-after-free in get_info()\\n\\nip6table_nat module unload has refcnt warning for UAF. call trace is:\\n\\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\\nModules linked in: ip6table_nat(-)\\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:module_put+0x6f/0x80\\nCall Trace:\\n <TASK>\\n get_info+0x128/0x180\\n do_ip6t_get_ctl+0x6a/0x430\\n nf_getsockopt+0x46/0x80\\n ipv6_getsockopt+0xb9/0x100\\n rawv6_getsockopt+0x42/0x190\\n do_sock_getsockopt+0xaa/0x180\\n __sys_getsockopt+0x70/0xc0\\n __x64_sys_getsockopt+0x20/0x30\\n do_syscall_64+0xa2/0x1a0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nConcurrent execution of module unload and get_info() trigered the warning.\\nThe root cause is as follows:\\n\\ncpu0\\t\\t\\t\\t cpu1\\nmodule_exit\\n//mod->state = MODULE_STATE_GOING\\n ip6table_nat_exit\\n xt_unregister_template\\n\\tkfree(t)\\n\\t//removed from templ_list\\n\\t\\t\\t\\t getinfo()\\n\\t\\t\\t\\t\\t t = xt_find_table_lock\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(tmpl, &xt_templates[af]...)\\n\\t\\t\\t\\t\\t\\t\\tif (strcmp(tmpl->name, name))\\n\\t\\t\\t\\t\\t\\t\\t\\tcontinue; //table not found\\n\\t\\t\\t\\t\\t\\t\\ttry_module_get\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(t, &xt_net->tables[af]...)\\n\\t\\t\\t\\t\\t\\t\\treturn t; //not get refcnt\\n\\t\\t\\t\\t\\t module_put(t->me) //uaf\\n unregister_pernet_subsys\\n //remove table from xt_net list\\n\\nWhile xt_table module was going away and has been removed from\\nxt_templates list, we couldnt get refcnt of xt_table->me. Check\\nmodule in xt_net->tables list re-traversal to fix it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: Se corrige el problema use-after-free en la descarga del módulo ip6table_nat get_info() que tiene una advertencia refcnt para UAF. El seguimiento de llamadas es: ADVERTENCIA: CPU: 1 PID: 379 en kernel/module/main.c:853 module_put+0x6f/0x80 Módulos vinculados en: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables No contaminado 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Seguimiento de llamadas: get_info+0x128/0x180 La ejecución simultánea de la descarga del módulo y get_info() activó la advertencia. La causa raíz es la siguiente: cpu0 cpu1 module_exit //mod->state = MODULE_STATE_GOING ip6table_nat_exit xt_unregister_template kfree(t) //eliminado de la lista de plantillas getinfo() t = xt_find_table_lock list_for_each_entry(tmpl, &xt_templates[af]...) if (strcmp(tmpl->name, name)) continue; //tabla no encontrada try_module_get list_for_each_entry(t, &xt_net->tables[af]...) return t; //no obtener refcnt module_put(t->me) //uaf unregister_pernet_subsys //eliminar tabla de la lista xt_net Mientras el módulo xt_table desaparecía y se eliminaba de la lista xt_templates, no pudimos obtener refcnt de xt_table->me. Verifique el módulo en el recorrido de lista xt_net->tables para solucionarlo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.171\",\"matchCriteriaId\":\"27CA367E-22E6-43BC-9062-CFFE67D00C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.116\",\"matchCriteriaId\":\"43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.60\",\"matchCriteriaId\":\"75088E5E-2400-4D20-915F-7A65C55D9CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}", vulnrichment: { containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50257\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:25:40.458302Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:25:41.600Z\"}}], \"cna\": {\"title\": \"netfilter: Fix use-after-free in get_info()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1\", \"lessThan\": \"ba22ea01348384df19cc1fabc7964be6e7189749\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1\", \"lessThan\": \"cb7c388b5967946f097afdb759b7c860305f2d96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1\", \"lessThan\": \"6a1f088f9807f5166f58902d26246d0b88da03a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1\", \"lessThan\": \"bab3bb35c03b263c486833d50d50c081d9e9832b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1\", \"lessThan\": \"f48d258f0ac540f00fa617dac496c4c18b5dc2fa\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/x_tables.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.171\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.116\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.60\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/x_tables.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749\"}, {\"url\": \"https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96\"}, {\"url\": \"https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8\"}, {\"url\": \"https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b\"}, {\"url\": \"https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: Fix use-after-free in get_info()\\n\\nip6table_nat module unload has refcnt warning for UAF. call trace is:\\n\\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\\nModules linked in: ip6table_nat(-)\\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:module_put+0x6f/0x80\\nCall Trace:\\n <TASK>\\n get_info+0x128/0x180\\n do_ip6t_get_ctl+0x6a/0x430\\n nf_getsockopt+0x46/0x80\\n ipv6_getsockopt+0xb9/0x100\\n rawv6_getsockopt+0x42/0x190\\n do_sock_getsockopt+0xaa/0x180\\n __sys_getsockopt+0x70/0xc0\\n __x64_sys_getsockopt+0x20/0x30\\n do_syscall_64+0xa2/0x1a0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nConcurrent execution of module unload and get_info() trigered the warning.\\nThe root cause is as follows:\\n\\ncpu0\\t\\t\\t\\t cpu1\\nmodule_exit\\n//mod->state = MODULE_STATE_GOING\\n ip6table_nat_exit\\n xt_unregister_template\\n\\tkfree(t)\\n\\t//removed from templ_list\\n\\t\\t\\t\\t getinfo()\\n\\t\\t\\t\\t\\t t = xt_find_table_lock\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(tmpl, &xt_templates[af]...)\\n\\t\\t\\t\\t\\t\\t\\tif (strcmp(tmpl->name, name))\\n\\t\\t\\t\\t\\t\\t\\t\\tcontinue; //table not found\\n\\t\\t\\t\\t\\t\\t\\ttry_module_get\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(t, &xt_net->tables[af]...)\\n\\t\\t\\t\\t\\t\\t\\treturn t; //not get refcnt\\n\\t\\t\\t\\t\\t module_put(t->me) //uaf\\n unregister_pernet_subsys\\n //remove table from xt_net list\\n\\nWhile xt_table module was going away and has been removed from\\nxt_templates list, we couldnt get refcnt of xt_table->me. Check\\nmodule in xt_net->tables list re-traversal to fix it.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:36:41.886Z\"}}}", cveMetadata: "{\"cveId\": \"CVE-2024-50257\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:36:41.886Z\", \"dateReserved\": \"2024-10-21T19:36:19.980Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:15:10.373Z\", \"assignerShortName\": \"Linux\"}", dataType: "CVE_RECORD", dataVersion: "5.1", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.