Executive brief
A vulnerability in the Linux kernel's network emulation component could allow a local user to cause a system crash or instability. The issue stems from how the system handles duplicated network packets, which can lead to memory corruption. This could result in a denial-of-service, impacting the availability of the affected system.
Technical details
A use-after-free vulnerability exists in netem_enqueue() within the Linux kernel's traffic control subsystem. The bug was introduced by incorrect return value handling when packets are duplicated; the function would return NET_XMIT_SUCCESS even if the enqueue failed. This causes the parent queuing discipline (qdisc) to incorrectly increment its packet length counter (qlen). During qdisc destruction, the mismatch causes the kernel to skip necessary cleanup (qlen_notify), resulting in dangling pointers in classful qdiscs like DRR. A local attacker can exploit this to trigger a use-after-free condition, leading to a kernel panic. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.0 to 5.4.283, 5.5 to 5.10.225, 5.11 to 5.15.166, 5.16 to 6.1.107, 6.2 to 6.6.48, 6.7 to 6.10.7
Timeline
- 2024-09-11: advisory: Initial disclosure and NVD publication
- 2024-08-29: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/0486d31dd8198e22b63a4730244b38fffce6d469
- https://git.kernel.org/stable/c/52d99a69f3d556c6426048c9d481b912205919d8
- https://git.kernel.org/stable/c/577d6c0619467fe90f7e8e57e45cb5bd9d936014
- https://git.kernel.org/stable/c/759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4
- https://git.kernel.org/stable/c/c07ff8592d57ed258afee5a5e04991a48dbaf382
- https://git.kernel.org/stable/c/c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d
- https://git.kernel.org/stable/c/e5bb2988a310667abed66c7d3ffa28880cf0f883