CVE-2024-50257

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-50257
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50257.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50257
Downstream
Related
Published
2024-11-09T10:15:10.373Z
Modified
2026-03-20T12:39:39.863935Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
netfilter: Fix use-after-free in get_info()
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: Fix use-after-free in get_info()

ip6table_nat module unload has refcnt warning for UAF. call trace is:

WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 moduleput+0x6f/0x80 Modules linked in: ip6tablenat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:moduleput+0x6f/0x80 Call Trace: <TASK> getinfo+0x128/0x180 doip6tgetctl+0x6a/0x430 nfgetsockopt+0x46/0x80 ipv6getsockopt+0xb9/0x100 rawv6getsockopt+0x42/0x190 dosockgetsockopt+0xaa/0x180 __sys_getsockopt+0x70/0xc0 __x64sysgetsockopt+0x20/0x30 dosyscall64+0xa2/0x1a0 entrySYSCALL64afterhwframe+0x77/0x7f

Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows:

cpu0 cpu1 moduleexit //mod->state = MODULESTATEGOING ip6tablenatexit xtunregistertemplate kfree(t) //removed from templlist getinfo() t = xtfindtablelock listforeachentry(tmpl, &xttemplates[af]...) if (strcmp(tmpl->name, name)) continue; //table not found trymoduleget listforeachentry(t, &xtnet->tables[af]...) return t; //not get refcnt moduleput(t->me) //uaf unregisterpernetsubsys //remove table from xt_net list

While xttable module was going away and has been removed from xttemplates list, we couldnt get refcnt of xttable->me. Check module in xtnet->tables list re-traversal to fix it.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50257.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fdacd57c79b79a03c7ca88f706ad9fb7b46831c1
Fixed
ba22ea01348384df19cc1fabc7964be6e7189749
Fixed
cb7c388b5967946f097afdb759b7c860305f2d96
Fixed
6a1f088f9807f5166f58902d26246d0b88da03a8
Fixed
bab3bb35c03b263c486833d50d50c081d9e9832b
Fixed
f48d258f0ac540f00fa617dac496c4c18b5dc2fa

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50257.json"