In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dstdestroy [1] Issue is in xfrm6netinit() and xfrm4netinit() : They copy xfrm[46]dstopstemplate into net->xfrm.xfrm[46]dstops. But net structure might be freed before all the dst callbacks are called. So when dstdestroy() calls later : if (dst->ops->destroy) dst->ops->destroy(dst); dst->ops points to the old net->xfrm.xfrm[46]dstops, which has been freed. See a relevant issue fixed in : ac888d58869b ("net: do not delay dstentriesadd() in dstrelease()") A fix is to queue the 'struct net' to be freed after one another cleanupnet() round (and existing rcubarrier()) [1] BUG: KASAN: slab-use-after-free in dstdestroy (net/core/dst.c:112) Read of size 8 at addr ffff8882137ccab0 by task swapper/37/0 Dec 03 05:46:18 kernel: CPU: 37 UID: 0 PID: 0 Comm: swapper/37 Kdump: loaded Not tainted 6.12.0 #67 Hardware name: Red Hat KVM/RHEL, BIOS 1.16.1-1.el9 04/01/2014 Call Trace: <IRQ> dumpstacklvl (lib/dumpstack.c:124) printaddressdescription.constprop.0 (mm/kasan/report.c:378) ? dstdestroy (net/core/dst.c:112) printreport (mm/kasan/report.c:489) ? dstdestroy (net/core/dst.c:112) ? kasanaddrtoslab (mm/kasan/common.c:37) kasanreport (mm/kasan/report.c:603) ? dstdestroy (net/core/dst.c:112) ? rcudobatch (kernel/rcu/tree.c:2567) dstdestroy (net/core/dst.c:112) rcudobatch (kernel/rcu/tree.c:2567) ? _pfxrcudobatch (kernel/rcu/tree.c:2491) ? lockdephardirqsonprepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406) rcucore (kernel/rcu/tree.c:2825) handlesoftirqs (kernel/softirq.c:554) _irqexitrcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637) irqexitrcu (kernel/softirq.c:651) sysvecapictimerinterrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049) </IRQ> <TASK> asmsysvecapictimerinterrupt (./arch/x86/include/asm/idtentry.h:702) RIP: 0010:defaultidle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:743) Code: 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d c7 c9 27 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 RSP: 0018:ffff888100d2fe00 EFLAGS: 00000246 RAX: 00000000001870ed RBX: 1ffff110201a5fc2 RCX: ffffffffb61a3e46 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb3d4d123 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed11c7e1835d R10: ffff888e3f0c1aeb R11: 0000000000000000 R12: 0000000000000000 R13: ffff888100d20000 R14: dffffc0000000000 R15: 0000000000000000 ? ctkernelexit.constprop.0 (kernel/contexttracking.c:148) ? cpuidleidlecall (kernel/sched/idle.c:186) defaultidlecall (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118) cpuidleidlecall (kernel/sched/idle.c:186) ? _pfxcpuidleidlecall (kernel/sched/idle.c:168) ? lockrelease (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5848) ? lockdephardirqsonprepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) ? tscverifytscadjust (arch/x86/kernel/tscsync.c:59) doidle (kernel/sched/idle.c:326) cpustartupentry (kernel/sched/idle.c:423 (discriminator 1)) startsecondary (arch/x86/kernel/smpboot.c:202 arch/x86/kernel/smpboot.c:282) ? _pfxstartsecondary (arch/x86/kernel/smpboot.c:232) ? softrestartcpu (arch/x86/kernel/head64.S:452) commonstartup64 (arch/x86/kernel/head64.S:414) </TASK> Dec 03 05:46:18 kernel: Allocated by task 12184: kasansavestack (mm/kasan/common.c:48) kasansavetrack (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) _kasanslaballoc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmemcacheallocnoprof (mm/slub.c:4085 mm/slub.c:4134 mm/slub.c:4141) copynetns (net/core/netnamespace.c:421 net/core/netnamespace.c:480) createnew_namespaces ---truncated---
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-19.19", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-buildinfo-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-buildinfo-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-cloud-tools-6.11.0-19" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-cloud-tools-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-headers-6.11.0-19" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-headers-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-headers-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-6.11.0-19-generic-dbgsym" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-unsigned-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-unsigned-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-unsigned-6.11.0-19-generic-64k-dbgsym" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-image-unsigned-6.11.0-19-generic-dbgsym" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-lib-rust-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-extra-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-ipu6-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-ipu7-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-iwlwifi-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-usbio-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-modules-vision-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-tools-6.11.0-19" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-tools-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-tools-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-19.19", "binary_name": "linux-tools-host" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1010.11", "binary_name": "linux-aws-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-aws-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-aws-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-cloud-tools-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-aws-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-extra-6.11.0-1010-aws" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-aws" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1010.10", "binary_name": "linux-azure-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-azure-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-azure-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-buildinfo-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-cloud-tools-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-headers-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-image-unsigned-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-image-unsigned-6.11.0-1010-azure-dbgsym" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-modules-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-modules-extra-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-modules-iwlwifi-6.11.0-1010-azure" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-tools-6.11.0-1010-azure" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1010.10", "binary_name": "linux-buildinfo-6.11.0-1010-gcp" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-gcp-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-gcp-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-headers-6.11.0-1010-gcp" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-image-unsigned-6.11.0-1010-gcp" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-image-unsigned-6.11.0-1010-gcp-dbgsym" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-modules-6.11.0-1010-gcp" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-modules-extra-6.11.0-1010-gcp" }, { "binary_version": "6.11.0-1010.10", "binary_name": "linux-tools-6.11.0-1010-gcp" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1012.13", "binary_name": "linux-buildinfo-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-buildinfo-6.11.0-1012-oracle-64k" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-headers-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-headers-6.11.0-1012-oracle-64k" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-image-unsigned-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-image-unsigned-6.11.0-1012-oracle-64k" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-image-unsigned-6.11.0-1012-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-image-unsigned-6.11.0-1012-oracle-dbgsym" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-modules-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-modules-6.11.0-1012-oracle-64k" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-modules-extra-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-modules-extra-6.11.0-1012-oracle-64k" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-oracle-headers-6.11.0-1012" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-oracle-tools-6.11.0-1012" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-tools-6.11.0-1012-oracle" }, { "binary_version": "6.11.0-1012.13", "binary_name": "linux-tools-6.11.0-1012-oracle-64k" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-raspi" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-raspi" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-6.11.0-1009-raspi" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-6.11.0-1009-raspi-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-raspi" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-raspi-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-raspi-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-raspi" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1006.6", "binary_name": "linux-buildinfo-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-cloud-tools-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-headers-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-image-unsigned-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-image-unsigned-6.11.0-1006-realtime-dbgsym" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-modules-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-modules-extra-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-modules-iwlwifi-6.11.0-1006-realtime" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-realtime-cloud-tools-6.11.0-1006" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-realtime-headers-6.11.0-1006" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-realtime-tools-6.11.0-1006" }, { "binary_version": "6.11.0-1006.6", "binary_name": "linux-tools-6.11.0-1006-realtime" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-buildinfo-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-headers-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-image-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-image-6.11.0-19-generic-dbgsym" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-modules-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-riscv-headers-6.11.0-19" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-riscv-tools-6.11.0-19" }, { "binary_version": "6.11.0-19.19.1", "binary_name": "linux-tools-6.11.0-19-generic" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-buildinfo-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-buildinfo-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-headers-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-headers-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-19" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-hwe-6.11-headers-6.11.0-19" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-hwe-6.11-tools-6.11.0-19" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-6.11.0-19-generic-dbgsym" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-19-generic-64k-dbgsym" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-19-generic-dbgsym" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-6.11.0-19-generic-64k" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-extra-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-ipu6-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-ipu7-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-usbio-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-modules-vision-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-tools-6.11.0-19-generic" }, { "binary_version": "6.11.0-19.19~24.04.1", "binary_name": "linux-tools-6.11.0-19-generic-64k" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "6.11.0-1016.16", "binary_name": "linux-buildinfo-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-headers-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-image-unsigned-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-image-unsigned-6.11.0-1016-oem-dbgsym" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-ipu6-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-ipu7-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-iwlwifi-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-usbio-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-modules-vision-6.11.0-1016-oem" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-oem-6.11-headers-6.11.0-1016" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-oem-6.11-tools-6.11.0-1016" }, { "binary_version": "6.11.0-1016.16", "binary_name": "linux-tools-6.11.0-1016-oem" } ], "priority_reason": "Use-after-free's can enable attackers to elevate privileges." }