Bug 2300409 (CVE-2024-41040) - CVE-2024-41040 kernel: net/sched: Fix UAF when resolving a clash
Summary: CVE-2024-41040 kernel: net/sched: Fix UAF when resolving a clash
Keywords:
Status: NEW
Alias: CVE-2024-41040
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2301566
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-29 15:33 UTC by OSIDB Bzimport
Modified: 2024-11-13 13:30 UTC (History)
4 users (show)

Fixed In Version: kernel 5.10.222, kernel 5.15.163, kernel 6.1.100, kernel 6.6.41, kernel 6.9.10, kernel 6.10
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the net/sshd tcf_ct_flow_table_process_conn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:6650 0 None None None 2024-09-12 14:28:39 UTC
Red Hat Product Errata RHBA-2024:7043 0 None None None 2024-09-24 09:43:22 UTC
Red Hat Product Errata RHBA-2024:7198 0 None None None 2024-09-26 09:49:03 UTC
Red Hat Product Errata RHBA-2024:7236 0 None None None 2024-09-26 14:37:54 UTC
Red Hat Product Errata RHBA-2024:7637 0 None None None 2024-10-03 14:46:12 UTC
Red Hat Product Errata RHBA-2024:8227 0 None None None 2024-10-17 06:46:25 UTC
Red Hat Product Errata RHSA-2024:6567 0 None None None 2024-09-11 00:57:56 UTC
Red Hat Product Errata RHSA-2024:7000 0 None None None 2024-09-24 02:35:05 UTC
Red Hat Product Errata RHSA-2024:7001 0 None None None 2024-09-24 00:39:42 UTC
Red Hat Product Errata RHSA-2024:8107 0 None None None 2024-10-15 00:35:45 UTC

Description OSIDB Bzimport 2024-07-29 15:33:28 UTC
In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix UAF when resolving a clash

KASAN reports the following UAF:

 BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]
 Read of size 1 at addr ffff888c07603600 by task handler130/6469

 Call Trace:
  <IRQ>
  dump_stack_lvl+0x48/0x70
  print_address_description.constprop.0+0x33/0x3d0
  print_report+0xc0/0x2b0
  kasan_report+0xd0/0x120
  __asan_load1+0x6c/0x80
  tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]
  tcf_ct_act+0x886/0x1350 [act_ct]
  tcf_action_exec+0xf8/0x1f0
  fl_classify+0x355/0x360 [cls_flower]
  __tcf_classify+0x1fd/0x330
  tcf_classify+0x21c/0x3c0
  sch_handle_ingress.constprop.0+0x2c5/0x500
  __netif_receive_skb_core.constprop.0+0xb25/0x1510
  __netif_receive_skb_list_core+0x220/0x4c0
  netif_receive_skb_list_internal+0x446/0x620
  napi_complete_done+0x157/0x3d0
  gro_cell_poll+0xcf/0x100
  __napi_poll+0x65/0x310
  net_rx_action+0x30c/0x5c0
  __do_softirq+0x14f/0x491
  __irq_exit_rcu+0x82/0xc0
  irq_exit_rcu+0xe/0x20
  common_interrupt+0xa1/0xb0
  </IRQ>
  <TASK>
  asm_common_interrupt+0x27/0x40

 Allocated by task 6469:
  kasan_save_stack+0x38/0x70
  kasan_set_track+0x25/0x40
  kasan_save_alloc_info+0x1e/0x40
  __kasan_krealloc+0x133/0x190
  krealloc+0xaa/0x130
  nf_ct_ext_add+0xed/0x230 [nf_conntrack]
  tcf_ct_act+0x1095/0x1350 [act_ct]
  tcf_action_exec+0xf8/0x1f0
  fl_classify+0x355/0x360 [cls_flower]
  __tcf_classify+0x1fd/0x330
  tcf_classify+0x21c/0x3c0
  sch_handle_ingress.constprop.0+0x2c5/0x500
  __netif_receive_skb_core.constprop.0+0xb25/0x1510
  __netif_receive_skb_list_core+0x220/0x4c0
  netif_receive_skb_list_internal+0x446/0x620
  napi_complete_done+0x157/0x3d0
  gro_cell_poll+0xcf/0x100
  __napi_poll+0x65/0x310
  net_rx_action+0x30c/0x5c0
  __do_softirq+0x14f/0x491

 Freed by task 6469:
  kasan_save_stack+0x38/0x70
  kasan_set_track+0x25/0x40
  kasan_save_free_info+0x2b/0x60
  ____kasan_slab_free+0x180/0x1f0
  __kasan_slab_free+0x12/0x30
  slab_free_freelist_hook+0xd2/0x1a0
  __kmem_cache_free+0x1a2/0x2f0
  kfree+0x78/0x120
  nf_conntrack_free+0x74/0x130 [nf_conntrack]
  nf_ct_destroy+0xb2/0x140 [nf_conntrack]
  __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]
  nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]
  __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]
  tcf_ct_act+0x12ad/0x1350 [act_ct]
  tcf_action_exec+0xf8/0x1f0
  fl_classify+0x355/0x360 [cls_flower]
  __tcf_classify+0x1fd/0x330
  tcf_classify+0x21c/0x3c0
  sch_handle_ingress.constprop.0+0x2c5/0x500
  __netif_receive_skb_core.constprop.0+0xb25/0x1510
  __netif_receive_skb_list_core+0x220/0x4c0
  netif_receive_skb_list_internal+0x446/0x620
  napi_complete_done+0x157/0x3d0
  gro_cell_poll+0xcf/0x100
  __napi_poll+0x65/0x310
  net_rx_action+0x30c/0x5c0
  __do_softirq+0x14f/0x491

The ct may be dropped if a clash has been resolved but is still passed to
the tcf_ct_flow_table_process_conn function for further usage. This issue
can be fixed by retrieving ct from skb again after confirming conntrack.

Comment 1 Mauro Matteo Cascella 2024-07-30 09:39:16 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072924-CVE-2024-41040-63d5@gregkh/T

Comment 2 Mauro Matteo Cascella 2024-07-30 09:39:37 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301566]

Comment 11 errata-xmlrpc 2024-09-11 00:57:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:6567 https://access.redhat.com/errata/RHSA-2024:6567

Comment 12 errata-xmlrpc 2024-09-24 00:39:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001

Comment 13 errata-xmlrpc 2024-09-24 02:35:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000

Comment 14 errata-xmlrpc 2024-10-15 00:35:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:8107 https://access.redhat.com/errata/RHSA-2024:8107


Note You need to log in before you can comment on or make changes to this bug.