Linux: Use After Free
CVE-2024-41040 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions b81a523d54ea689414f67c9fb81a5b917a41ed55, 2b4d68df3f57ea746c430941ba9c03d7d8b5a23f, 4e71b10a100861fb27d9c5755dfd68f615629fae as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1% chance of exploitation within 30 days, higher than 63% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to b81a523d54ea689414f67c9fb81a5b917a41ed55 or 2b4d68df3f57ea746c430941ba9c03d7d8b5a23f or 4e71b10a100861fb27d9c5755dfd68f615629fae or 799a34901b634008db4a7ece3900e2b971d4c932, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.222 or 5.13 or 5.15.163 or 6.1.100, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | f07c548314776231f0d47d73ec6caa5b17e876e8 up to, but not including, b81a523d54ea689414f67c9fb81a5b917a41ed55; 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 up to, but not including, 2b4d68df3f57ea746c430941ba9c03d7d8b5a23f; 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 up to, but not including, 4e71b10a100861fb27d9c5755dfd68f615629fae; 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 up to, but not including, 799a34901b634008db4a7ece3900e2b971d4c932; 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 up to, but not including, ef472cc6693b16b202a916482df72f35d94bd69e; 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 up to, but not including, 26488172b0292bed837b95a006a3f3431d1898c3; 30822781c89943b6a3ed122324ceb37cea7042a3; 5.10.43 up to, but not including, 5.10.222; and 2 more ranges | b81a523d54ea689414f67c9fb81a5b917a41ed55, 2b4d68df3f57ea746c430941ba9c03d7d8b5a23f, 4e71b10a100861fb27d9c5755dfd68f615629fae, 799a34901b634008db4a7ece3900e2b971d4c932, ef472cc6693b16b202a916482df72f35d94bd69e, 26488172b0292bed837b95a006a3f3431d1898c3 |
| Linux | Linux Kernel | 5.10.43 up to, but not including, 5.10.222; 5.12.10 up to, but not including, 5.13; 5.13 up to, but not including, 5.15.163; 5.16 up to, but not including, 6.1.100; 6.2 up to, but not including, 6.6.41; 6.7 up to, but not including, 6.9.10 | 5.10.222, 5.13, 5.15.163, 6.1.100, 6.6.41, 6.9.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA |
| CVSS 3.1 | 7.0 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1/0xb0 </IRQ> <TASK> asm_common_interrupt+0x27/0x40 Allocated by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_alloc_info+0x1e/0x40 __kasan_krealloc+0x133/0x190 krealloc+0xaa/0x130 nf_ct_ext_add+0xed/0x230 [nf_conntrack] tcf_ct_act+0x1095/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 Freed by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_free_info+0x2b/0x60 ____kasan_slab_free+0x180/0x1f0 __kasan_slab_free+0x12/0x30 slab_free_freelist_hook+0xd2/0x1a0 __kmem_cache_free+0x1a2/0x2f0 kfree+0x78/0x120 nf_conntrack_free+0x74/0x130 [nf_conntrack] nf_ct_destroy+0xb2/0x140 [nf_conntrack] __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack] nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack] __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack] tcf_ct_act+0x12ad/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 The ct may be dropped if a clash has been resolved but is still passed to the tcf_ct_flow_table_process_conn function for further usage. This issue can be fixed by retrieving ct from skb again after confirming conntrack.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3
- git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f
- git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae
- git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932
- git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55
- git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.