CVE-2024-50036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-50036
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50036.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50036
Downstream
Related
Published
2024-10-21T19:39:37.135Z
Modified
2026-03-20T12:39:32.445535Z
Summary
net: do not delay dst_entries_add() in dst_release()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: do not delay dstentriesadd() in dst_release()

dstentriesadd() uses per-cpu data that might be freed at netns dismantle from ip6routenetexit() calling dstentries_destroy()

Before ip6routenetexit() can be called, we release all the dsts associated with this netns, via calls to dstrelease(), which waits an rcu grace period before calling dst_destroy()

dstentriesadd() use in dstdestroy() is racy, because dstentries_destroy() could have been called already.

Decrementing the number of dsts must happen sooner.

Notes:

1) in CONFIGXFRM case, dstdestroy() can call dstreleaseimmediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this.

2) There is also discussion about removing this count of dst, which might happen in future kernels.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50036.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f88649721268999bdff09777847080a52004f691
Fixed
547087307bc19417b4f2bc85ba9664a3e8db5a6a
Fixed
e3915f028b1f1c37e87542e5aadd33728c259d96
Fixed
a60db84f772fc3a906c6c4072f9207579c41166f
Fixed
eae7435b48ffc8e9be0ff9cfeae40af479a609dd
Fixed
3c7c918ec0aa3555372c5a57f18780b7a96c5cfc
Fixed
ac888d58869bb99753e7652be19a151df9ecb35d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41
Last affected
591b1e1bb40152e22cee757f493046a0ca946bf8
Last affected
df90819dafcd6b97fc665f63a15752a570e227a2
Last affected
9a4fe697023dbe6c25caa1f8b2153af869a29bd2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50036.json"