CyberSecBulletin
CVE-2024-26804NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-26804 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f81e94d2dcd2397137edcb8b85f4c5bed5d22383, 2e95350fe9db9d53c701075060ac8ac883b68aee, afec0c5cd2ed71ca95a8b36a5e6d03333bf34282 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f81e94d2dcd2397137edcb8b85f4c5bed5d22383 or 2e95350fe9db9d53c701075060ac8ac883b68aee or afec0c5cd2ed71ca95a8b36a5e6d03333bf34282 or ab63de24ebea36fe73ac7121738595d704b66d96, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.271 or 5.10.212 or 5.15.151 or 6.1.81, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, f81e94d2dcd2397137edcb8b85f4c5bed5d22383; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, 2e95350fe9db9d53c701075060ac8ac883b68aee; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, afec0c5cd2ed71ca95a8b36a5e6d03333bf34282; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, ab63de24ebea36fe73ac7121738595d704b66d96; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, 049d7989c67e8dd50f07a2096dbafdb41331fb9b; 243aad830e8a4cdda261626fbaeddde16b08d04a up to, but not including, 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f; 03017375b0122453e6dda833ff7bd4191915def5; and 2 more rangesf81e94d2dcd2397137edcb8b85f4c5bed5d22383, 2e95350fe9db9d53c701075060ac8ac883b68aee, afec0c5cd2ed71ca95a8b36a5e6d03333bf34282, ab63de24ebea36fe73ac7121738595d704b66d96, a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9, 049d7989c67e8dd50f07a2096dbafdb41331fb9b
LinuxLinux Kernel2.6.34 up to, but not including, 5.4.271; 5.5 up to, but not including, 5.10.212; 5.11 up to, but not including, 5.15.151; 5.16 up to, but not including, 6.1.81; 6.2 up to, but not including, 6.6.21; 6.7 up to, but not including, 6.7.9; 6.85.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Use After Free vulnerabilities

Spotted an error? Tell us.