Linux: Use After Free
CVE-2024-26961 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 068ab2759bc0b4daf0b964de61b2731449c86531, d3d858650933d44ac12c1f31337e7110c2071821, dcd51ab42b7a0431575689c5f74b8b6efd45fc2f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 068ab2759bc0b4daf0b964de61b2731449c86531 or d3d858650933d44ac12c1f31337e7110c2071821 or dcd51ab42b7a0431575689c5f74b8b6efd45fc2f or 20d3e1c8a1847497269f04d874b2a5818ec29e2d, whichever matches your release line, or a later version.
- Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
- Update Linux Kernel to 5.10.215 or 5.15.154 or 6.1.84 or 6.6.24, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, 068ab2759bc0b4daf0b964de61b2731449c86531; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, d3d858650933d44ac12c1f31337e7110c2071821; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, dcd51ab42b7a0431575689c5f74b8b6efd45fc2f; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, 20d3e1c8a1847497269f04d874b2a5818ec29e2d; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, 640297c3e897bd7e1481466a6a5cb9560f1edb88; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, 49c8951680d7b76fceaee89dcfbab1363fb24fd1; 5d637d5aabd85132bd85779677d8acb708e0ed90 up to, but not including, e8a1e58345cf40b7b272e08ac7b32328b2543e40; 3.16 | 068ab2759bc0b4daf0b964de61b2731449c86531, d3d858650933d44ac12c1f31337e7110c2071821, dcd51ab42b7a0431575689c5f74b8b6efd45fc2f, 20d3e1c8a1847497269f04d874b2a5818ec29e2d, 640297c3e897bd7e1481466a6a5cb9560f1edb88, 49c8951680d7b76fceaee89dcfbab1363fb24fd1 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
| Linux | Linux Kernel | 3.16 up to, but not including, 5.10.215; 5.11 up to, but not including, 5.15.154; 5.16 up to, but not including, 6.1.84; 6.2 up to, but not including, 6.6.24; 6.7 up to, but not including, 6.7.12; 6.8 up to, but not including, 6.8.3 | 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.0 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531
- git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d
- git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1
- git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88
- git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821
- git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f
- git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlMailing List, Third Party Advisory
Other references
Recent Use After Free vulnerabilities
- 9.8 Critical severity
- 8.8 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.