Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system incorrectly handles network namespaces, which are used to isolate network resources between different processes. This flaw could lead to a 'use-after-free' condition, impacting the overall stability and security of the operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel's netns component due to improper reference counting in get_net_ns(). The vulnerability is triggered when the TUNGETDEVNETNS ioctl is called on a TUN device that has been moved to a different network namespace that is subsequently deleted. When the ioctl attempts to retrieve the network namespace, get_net_ns() performs a refcount addition on a zeroed reference counter, leading to a kernel warning or panic. An attacker with local access can exploit this race condition to trigger a use-after-free. The fix replaces get_net() with maybe_get_net() to safely handle cases where the namespace's reference count has already reached zero.
Affected products
- Linux Linux Kernel Fixed in 6.10-rc3 and various stable branches
Timeline
- 2024-06-14: patched: Initial patch submitted by Yue Haibing
- 2024-07-12: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1b631bffcb2c09551888f3c723f4365c91fe05ef
- https://git.kernel.org/stable/c/2b82028a1f5ee3a8e04090776b10c534144ae77b
- https://git.kernel.org/stable/c/3a6cd326ead7c8bb1f64486789a01974a9f1ad55
- https://git.kernel.org/stable/c/3af28df0d883e8c89a29ac31bc65f9023485743b
- https://git.kernel.org/stable/c/cb7f811f638a14590ff98f53c6dd1fb54627d940
- https://git.kernel.org/stable/c/ef0394ca25953ea0eddcc82feae1f750451f1876
- https://git.kernel.org/stable/c/ff960f9d3edbe08a736b5a224d91a305ccc946b0