CVE-2024-50036

Scores

EPSS

0.000very_low0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

7.0high3.x
0246810

CVSS Score: 7.0/10

All CVSS Scores

CVSS 3.x
7.0

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In the Linux kernel, the following vulnerability has been resolved:

net: do not delay dst_entries_add() in dst_release()

dst_entries_add() uses per-cpu data that might be freed at netns
dismantle from ip6_route_net_exit() calling dst_entries_destroy()

Before ip6_route_net_exit() can be called, we release all
the dsts associated with this netns, via calls to dst_release(),
which waits an rcu grace period before calling dst_destroy()

dst_entries_add() use in dst_destroy() is racy, because
dst_entries_destroy() could have been called already.

Decrementing the number of dsts must happen sooner.

Notes:

1) in CONFIG_XFRM case, dst_destroy() can call
dst_release_immediate(child), this might also cause UAF
if the child does not have DST_NOCOUNT set.
IPSEC maintainers might take a look and see how to address this.

2) There is also discussion about removing this count of dst,
which might happen in future kernels.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

astradebiannvdubuntu

CWEs

CWE-416

Vulnerable Software (164)

Type: Configuration

Product: linux

Operating System: ubuntu bionic 18.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: linux

Operating System: ubuntu focal 20.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: linux

Operating System: ubuntu jammy 22.04

Trait:
{  "fixed": "5.15.0-133.144"}

Source: ubuntu

Type: Configuration

Product: linux

Operating System: ubuntu trusty 14.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: linux

Operating System: ubuntu xenial 16.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: linux

Operating System: debian

Trait:
{  "fixed": "6.11.4-1"}

Source: debian

Type: Configuration

Product: linux-5.10

Operating System: astra 4.7.7.4

Trait:
{  "unaffected": true}

Source: astra

Type: Configuration

Product: linux-5.10

Operating System: astra 1.7.7.6

Trait:
{  "unaffected": true}

Source: astra

Type: Configuration

Product: linux-6.1

Operating System: astra 4.7.7.4

Trait:
{  "unaffected": true}

Source: astra

Type: Configuration

Product: linux-6.1

Operating System: astra 1.7.7.6

Trait:
{  "unaffected": true}

Source: astra