AZL-42615
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-42615.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-42615
- Upstream
- Published
- 2024-06-10T09:15:09Z
- Modified
- 2026-04-01T05:14:46.808150Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2024-36971 affecting package kernel for versions less than 6.6.35.1-4
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: fix __dstnegativeadvice() race
_dstnegativeadvice() does not enforce proper RCU rules when sk->dstcache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->skdstcache, then call dstrelease(olddst).
Note that skdstreset(sk) is implementing this protocol correctly, while __dstnegativeadvice() uses the wrong order.
Given that ip6negativeadvice() has special logic against RTFCACHE, this means each of the three ->negativeadvice() existing methods must perform the skdstreset() themselves.
Note the check against NULL dst is centralized in __dstnegativeadvice(), there is no need to duplicate it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
- References