Vulnerability-Lookup

GHSA-WQMJ-2MP9-XQMR

Vulnerability from github – Published: 2024-11-05 18:32 – Updated: 2024-11-08 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: must hold reference on net namespace

BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60

Eric says: It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpf_nf_link_attach() does : link->net = net; But I do not see a reference being taken on net.

Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-05T18:15:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: must hold reference on net namespace\n\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\nbpf_nf_link_release+0xda/0x1e0\nbpf_link_free+0x139/0x2d0\nbpf_link_release+0x68/0x80\n__fput+0x414/0xb60\n\nEric says:\n It seems that bpf was able to defer the __nf_unregister_net_hook()\n after exit()/close() time.\n Perhaps a netns reference is missing, because the netns has been\n dismantled/freed already.\n bpf_nf_link_attach() does :\n link-\u003enet = net;\n But I do not see a reference being taken on net.\n\nAdd such a reference and release it after hook unreg.\nNote that I was unable to get syzbot reproducer to work, so I\ndo not know if this resolves this splat.",
  "id": "GHSA-wqmj-2mp9-xqmr",
  "modified": "2024-11-08T00:30:45Z",
  "published": "2024-11-05T18:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50130"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-50130 (GCVE-0-2024-50130)

Vulnerability from cvelistv5 – Published: 2024-11-05 17:10 – Updated: 2026-08-05 11:41

Title

netfilter: bpf: must hold reference on net namespace

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric says: It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpf_nf_link_attach() does : link->net = net; But I do not see a reference being taken on net. Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-06 16:08 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/f41bd93b3e0508edc…
https://git.kernel.org/stable/c/d0d7939543a1b3bb9…
https://git.kernel.org/stable/c/1230fe7ad3974f7bf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 84601d6ee68ae820dec97450934797046d62db4b , < f41bd93b3e0508edc7ba820357f949071dcc0acc (git) Affected: 84601d6ee68ae820dec97450934797046d62db4b , < d0d7939543a1b3bb93af9a18d258a774daf8f162 (git) Affected: 84601d6ee68ae820dec97450934797046d62db4b , < 1230fe7ad3974f7bf6c78901473e039b34d4fb1f (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.59 , ≤ 6.6.* (semver) Unaffected: 6.11.6 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T16:08:04.815447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T16:14:33.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f41bd93b3e0508edc7ba820357f949071dcc0acc",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "d0d7939543a1b3bb93af9a18d258a774daf8f162",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "1230fe7ad3974f7bf6c78901473e039b34d4fb1f",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: must hold reference on net namespace\n\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\nbpf_nf_link_release+0xda/0x1e0\nbpf_link_free+0x139/0x2d0\nbpf_link_release+0x68/0x80\n__fput+0x414/0xb60\n\nEric says:\n It seems that bpf was able to defer the __nf_unregister_net_hook()\n after exit()/close() time.\n Perhaps a netns reference is missing, because the netns has been\n dismantled/freed already.\n bpf_nf_link_attach() does :\n link-\u003enet = net;\n But I do not see a reference being taken on net.\n\nAdd such a reference and release it after hook unreg.\nNote that I was unable to get syzbot reproducer to work, so I\ndo not know if this resolves this splat."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is the `bpf(BPF_LINK_CREATE)` syscall combined with `unshare(CLONE_NEWNET)`/`setns()` and `close()` of the link fd, all of which require an executing context on the local machine. No network peer, adjacent-network frame, or physical bus is involved in triggering the dangling `link-\u003enet`.\nAC:L - The attacker performs every step of the sequence themselves \u2014 create the netns, attach the link, drop the last netns reference, wait for `cleanup_net()` to free the `struct net`, then close the fd \u2014 with no race against another party and no unpredictable precondition. Heap grooming of the `net_namespace` cache is done by the attacker\u0027s own repeated namespace creation, and the trigger can be repeated arbitrarily.\nPR:L - Reaching `bpf_nf_link_attach()` needs only `CAP_BPF` plus `CAP_NET_ADMIN` at prog-load time, and `bpf_token_capable()` falls back to `ns_capable(token-\u003euserns, ...)`, so a delegated bpffs BPF token \u2014 the mechanism built expressly for containers \u2014 grants it to an unprivileged user-namespace process; netns creation itself needs only `ns_capable(CAP_SYS_ADMIN)` via `unshare -Ur`. These are non-root, delegable capabilities commonly held by ordinary observability/networking daemons, consistent with kernel CNA precedent for CAP_BPF-gated bugs.\nUI:N - The attacking process creates the namespace, attaches the link, releases the namespace and closes the descriptor entirely within its own context. No victim needs to mount, open, configure, or click anything.\nS:U - The use-after-free occurs in kernel memory and the resulting corruption is confined to the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or VM boundary is crossed.\nC:H - This is a slab use-after-free on `struct net` \u2014 KASAN reports an 8-byte read of freed memory in `__nf_unregister_net_hook()`, and the stale `nf_hook_entries` pointer it yields is then walked and copied by `__nf_hook_entries_try_shrink()` into a fresh allocation. With the freed object reclaimed under attacker-controlled content this becomes a controlled read of arbitrary kernel memory, and it also leaks kernel text/heap addresses of adjacent namespace state.\nI:H - After the freed `struct net` is reallocated, `nf_remove_net_hook()` writes `accept_all` and `\u0026dummy_ops` \u2014 known kernel addresses \u2014 through a pointer and index taken from attacker-groomed memory, and `bpf_nf_disable_defrag()` decrements/zeroes `net-\u003enf.defrag_ipv4_users` in the freed object. That is a write primitive at an attacker-influenced address, sufficient to corrupt another namespace\u0027s netfilter hook table or to build control-flow hijack toward privilege escalation.\nA:H - Even without exploitation the bug is a confirmed KASAN slab-use-after-free that dereferences freed and possibly reused memory in `__nf_unregister_net_hook()`, trips `WARN_ON_ONCE(!p)`/`WARN_ONCE(1, \"hook not found\")`, and readily oopses or panics the kernel. It also leaks the entire `nf_hook_entries` blob of every torn-down namespace, and can be repeated in a loop to reliably crash the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:55.252Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162"
        },
        {
          "url": "https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f"
        }
      ],
      "title": "netfilter: bpf: must hold reference on net namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50130",
    "datePublished": "2024-11-05T17:10:56.344Z",
    "dateReserved": "2024-10-21T19:36:19.955Z",
    "dateUpdated": "2026-08-05T11:41:55.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.