CVE-2024-46800

2024-09-1808:15:06

Linux

web.nvd.nist.gov

linux kernel vulnerability

cve-2024-46800

fix

netem

use after free

kasan uaf

command injection

AI Score

6.9

Confidence

High

EPSS

Percentile

13.8%

JSON

In the Linux kernel, the following vulnerability has been resolved:

sch/netem: fix use after free in netem_dequeue

If netem_dequeue() enqueues packet to inner qdisc and that qdisc
returns __NET_XMIT_STOLEN. The packet is dropped but
qdisc_tree_reduce_backlog() is not called to update the parent’s
q.qlen, leading to the similar use-after-free as Commit
e04991a48dbaf382 (“netem: fix return value if duplicate enqueue
fails”)

Commands to trigger KASAN UaF:

ip link add type dummy
ip link set lo up
ip link set dummy0 up
tc qdisc add dev lo parent root handle 1: drr
tc filter add dev lo parent 1: basic classid 1:1
tc class add dev lo classid 1:1 drr
tc qdisc add dev lo parent 1:1 handle 2: netem
tc qdisc add dev lo parent 2: handle 3: drr
tc filter add dev lo parent 3: basic classid 3:1 action mirred egress
redirect dev dummy0
tc class add dev lo classid 3:1 drr
ping -c1 -W0.01 localhost # Trigger bug
tc class del dev lo classid 1:1
tc class add dev lo classid 1:1 drr
ping -c1 -W0.01 localhost # UaF

Affected configurations

Vulners

Node

linuxlinux_kernelRange3.3–4.19.322

linuxlinux_kernelRange4.20.0–5.4.284

linuxlinux_kernelRange5.5.0–5.10.226

linuxlinux_kernelRange5.11.0–5.15.167

linuxlinux_kernelRange5.16.0–6.1.110

linuxlinux_kernelRange6.2.0–6.6.51

linuxlinux_kernelRange6.7.0–6.10.10

linuxlinux_kernelRange6.11.0≥

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/sched/sch_netem.c"
    ],
    "versions": [
      {
        "version": "50612537e9ab",
        "lessThan": "f0bddb4de043",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "295ad5afd9ef",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "98c75d761879",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "14f91ab8d391",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "db2c23568291",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "dde33a9d0b80",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "32008ab989dd",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "50612537e9ab",
        "lessThan": "3b3a2a9c6349",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/sched/sch_netem.c"
    ],
    "versions": [
      {
        "version": "3.3",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.3",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "4.19.322",
        "lessThanOrEqual": "4.19.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.284",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.226",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.167",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.110",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.51",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.10",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]