cve-2024-50257
Vulnerability from cvelistv5
Published
2024-11-09 10:15
Modified
2024-12-19 09:36
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: Fix use-after-free in get_info()
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80
Modules linked in: ip6table_nat(-)
CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:module_put+0x6f/0x80
Call Trace:
<TASK>
get_info+0x128/0x180
do_ip6t_get_ctl+0x6a/0x430
nf_getsockopt+0x46/0x80
ipv6_getsockopt+0xb9/0x100
rawv6_getsockopt+0x42/0x190
do_sock_getsockopt+0xaa/0x180
__sys_getsockopt+0x70/0xc0
__x64_sys_getsockopt+0x20/0x30
do_syscall_64+0xa2/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning.
The root cause is as follows:
cpu0 cpu1
module_exit
//mod->state = MODULE_STATE_GOING
ip6table_nat_exit
xt_unregister_template
kfree(t)
//removed from templ_list
getinfo()
t = xt_find_table_lock
list_for_each_entry(tmpl, &xt_templates[af]...)
if (strcmp(tmpl->name, name))
continue; //table not found
try_module_get
list_for_each_entry(t, &xt_net->tables[af]...)
return t; //not get refcnt
module_put(t->me) //uaf
unregister_pernet_subsys
//remove table from xt_net list
While xt_table module was going away and has been removed from
xt_templates list, we couldnt get refcnt of xt_table->me. Check
module in xt_net->tables list re-traversal to fix it.
References
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-50257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-11T14:25:40.458302Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T14:58:32.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/x_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba22ea01348384df19cc1fabc7964be6e7189749",
"status": "affected",
"version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
"versionType": "git"
},
{
"lessThan": "cb7c388b5967946f097afdb759b7c860305f2d96",
"status": "affected",
"version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
"versionType": "git"
},
{
"lessThan": "6a1f088f9807f5166f58902d26246d0b88da03a8",
"status": "affected",
"version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
"versionType": "git"
},
{
"lessThan": "bab3bb35c03b263c486833d50d50c081d9e9832b",
"status": "affected",
"version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
"versionType": "git"
},
{
"lessThan": "f48d258f0ac540f00fa617dac496c4c18b5dc2fa",
"status": "affected",
"version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/x_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: Fix use-after-free in get_info()\n\nip6table_nat module unload has refcnt warning for UAF. call trace is:\n\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\nModules linked in: ip6table_nat(-)\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:module_put+0x6f/0x80\nCall Trace:\n \u003cTASK\u003e\n get_info+0x128/0x180\n do_ip6t_get_ctl+0x6a/0x430\n nf_getsockopt+0x46/0x80\n ipv6_getsockopt+0xb9/0x100\n rawv6_getsockopt+0x42/0x190\n do_sock_getsockopt+0xaa/0x180\n __sys_getsockopt+0x70/0xc0\n __x64_sys_getsockopt+0x20/0x30\n do_syscall_64+0xa2/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nConcurrent execution of module unload and get_info() trigered the warning.\nThe root cause is as follows:\n\ncpu0\t\t\t\t cpu1\nmodule_exit\n//mod-\u003estate = MODULE_STATE_GOING\n ip6table_nat_exit\n xt_unregister_template\n\tkfree(t)\n\t//removed from templ_list\n\t\t\t\t getinfo()\n\t\t\t\t\t t = xt_find_table_lock\n\t\t\t\t\t\tlist_for_each_entry(tmpl, \u0026xt_templates[af]...)\n\t\t\t\t\t\t\tif (strcmp(tmpl-\u003ename, name))\n\t\t\t\t\t\t\t\tcontinue; //table not found\n\t\t\t\t\t\t\ttry_module_get\n\t\t\t\t\t\tlist_for_each_entry(t, \u0026xt_net-\u003etables[af]...)\n\t\t\t\t\t\t\treturn t; //not get refcnt\n\t\t\t\t\t module_put(t-\u003eme) //uaf\n unregister_pernet_subsys\n //remove table from xt_net list\n\nWhile xt_table module was going away and has been removed from\nxt_templates list, we couldnt get refcnt of xt_table-\u003eme. Check\nmodule in xt_net-\u003etables list re-traversal to fix it."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:36:41.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749"
},
{
"url": "https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96"
},
{
"url": "https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8"
},
{
"url": "https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b"
},
{
"url": "https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa"
}
],
"title": "netfilter: Fix use-after-free in get_info()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-50257",
"datePublished": "2024-11-09T10:15:10.373Z",
"dateReserved": "2024-10-21T19:36:19.980Z",
"dateUpdated": "2024-12-19T09:36:41.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-50257\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:11.340\",\"lastModified\":\"2024-12-11T15:15:13.913\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: Fix use-after-free in get_info()\\n\\nip6table_nat module unload has refcnt warning for UAF. call trace is:\\n\\nWARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80\\nModules linked in: ip6table_nat(-)\\nCPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:module_put+0x6f/0x80\\nCall Trace:\\n \u003cTASK\u003e\\n get_info+0x128/0x180\\n do_ip6t_get_ctl+0x6a/0x430\\n nf_getsockopt+0x46/0x80\\n ipv6_getsockopt+0xb9/0x100\\n rawv6_getsockopt+0x42/0x190\\n do_sock_getsockopt+0xaa/0x180\\n __sys_getsockopt+0x70/0xc0\\n __x64_sys_getsockopt+0x20/0x30\\n do_syscall_64+0xa2/0x1a0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nConcurrent execution of module unload and get_info() trigered the warning.\\nThe root cause is as follows:\\n\\ncpu0\\t\\t\\t\\t cpu1\\nmodule_exit\\n//mod-\u003estate = MODULE_STATE_GOING\\n ip6table_nat_exit\\n xt_unregister_template\\n\\tkfree(t)\\n\\t//removed from templ_list\\n\\t\\t\\t\\t getinfo()\\n\\t\\t\\t\\t\\t t = xt_find_table_lock\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(tmpl, \u0026xt_templates[af]...)\\n\\t\\t\\t\\t\\t\\t\\tif (strcmp(tmpl-\u003ename, name))\\n\\t\\t\\t\\t\\t\\t\\t\\tcontinue; //table not found\\n\\t\\t\\t\\t\\t\\t\\ttry_module_get\\n\\t\\t\\t\\t\\t\\tlist_for_each_entry(t, \u0026xt_net-\u003etables[af]...)\\n\\t\\t\\t\\t\\t\\t\\treturn t; //not get refcnt\\n\\t\\t\\t\\t\\t module_put(t-\u003eme) //uaf\\n unregister_pernet_subsys\\n //remove table from xt_net list\\n\\nWhile xt_table module was going away and has been removed from\\nxt_templates list, we couldnt get refcnt of xt_table-\u003eme. Check\\nmodule in xt_net-\u003etables list re-traversal to fix it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: Se corrige el problema use-after-free en la descarga del m\u00f3dulo ip6table_nat get_info() que tiene una advertencia refcnt para UAF. El seguimiento de llamadas es: ADVERTENCIA: CPU: 1 PID: 379 en kernel/module/main.c:853 module_put+0x6f/0x80 M\u00f3dulos vinculados en: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables No contaminado 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Seguimiento de llamadas: get_info+0x128/0x180 La ejecuci\u00f3n simult\u00e1nea de la descarga del m\u00f3dulo y get_info() activ\u00f3 la advertencia. La causa ra\u00edz es la siguiente: cpu0 cpu1 module_exit //mod-\u0026gt;state = MODULE_STATE_GOING ip6table_nat_exit xt_unregister_template kfree(t) //eliminado de la lista de plantillas getinfo() t = xt_find_table_lock list_for_each_entry(tmpl, \u0026amp;xt_templates[af]...) if (strcmp(tmpl-\u0026gt;name, name)) continue; //tabla no encontrada try_module_get list_for_each_entry(t, \u0026amp;xt_net-\u0026gt;tables[af]...) return t; //no obtener refcnt module_put(t-\u0026gt;me) //uaf unregister_pernet_subsys //eliminar tabla de la lista xt_net Mientras el m\u00f3dulo xt_table desaparec\u00eda y se eliminaba de la lista xt_templates, no pudimos obtener refcnt de xt_table-\u0026gt;me. Verifique el m\u00f3dulo en el recorrido de lista xt_net-\u0026gt;tables para solucionarlo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.171\",\"matchCriteriaId\":\"27CA367E-22E6-43BC-9062-CFFE67D00C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.116\",\"matchCriteriaId\":\"43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.60\",\"matchCriteriaId\":\"75088E5E-2400-4D20-915F-7A65C55D9CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.