Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when specific network traffic control settings (qdiscs) are combined in a way the system cannot handle, leading to a kernel crash. This impacts system availability and could be used to disrupt operations or services running on the affected host.
Technical details
A NULL pointer dereference exists in the Linux kernel's network scheduler (net/sched) due to improper handling of size tables (TCA_STAB) in nested queuing disciplines (qdiscs). Most qdiscs assume packet length is invariant between enqueue and dequeue operations; however, applying a size table to a non-root qdisc (such as an SFQ nested under a TBF) violates this assumption and leads to memory corruption or a NULL pointer dereference during dequeue or reset operations. An attacker with local privileges to configure network interfaces (e.g., CAP_NET_ADMIN) can trigger this crash. The fix restricts TCA_STAB configuration to root qdiscs only. Patches have been released for various stable kernel branches (e.g., 6.11.y, 6.6.y, 6.1.y).
Affected products
- Linux Linux Kernel All versions prior to the October 2024 patches
Timeline
- 2024-10-07: patched: Initial fix authored by Eric Dumazet
- 2024-10-21: disclosed: CVE-2024-50039 published
References
- https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e
- https://git.kernel.org/stable/c/2acbb9539bc2284e30d2aeb789c3d96287014264
- https://git.kernel.org/stable/c/3cb7cf1540ddff5473d6baeb530228d19bc97b8a
- https://git.kernel.org/stable/c/3dc6ee96473cc2962c6db4297d4631f261be150f
- https://git.kernel.org/stable/c/76feedc74b90270390fbfdf74a2e944e96872363
- https://git.kernel.org/stable/c/8fb6503592d39065316f45d267c5527b4e7cd995
- https://git.kernel.org/stable/c/adbc3eef43fc94c7c8436da832691ae02333a972