Linux: Use After Free
CVE-2024-44987 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 571567e0277008459750f0728f246086b2659429, ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8, cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 571567e0277008459750f0728f246086b2659429 or ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8 or cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e or 24e93695b1239fbe4c31e224372be77f82dab69a, whichever matches your release line, or a later version.
- Update RUGGEDCOM RST2428P to V3.1 or V3.2, whichever matches your release line, or a later version.
- Update SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family to V3.2 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, 571567e0277008459750f0728f246086b2659429; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, 24e93695b1239fbe4c31e224372be77f82dab69a; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, 9a3e55afa95ed4ac9eda112d4f918af645d72f25; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, af1dde074ee2ed7dd5bdca4e7e8ba17f44e7b011; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, e44bd76dd072756e674f45c5be00153f4ded68b2; 0625491493d9000e4556bf566d205c28c8e7dc4e up to, but not including, faa389b2fbaaec7fd27a390b4896139f9da662e3; and 1 more ranges | 571567e0277008459750f0728f246086b2659429, ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8, cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e, 24e93695b1239fbe4c31e224372be77f82dab69a, 9a3e55afa95ed4ac9eda112d4f918af645d72f25, af1dde074ee2ed7dd5bdca4e7e8ba17f44e7b011 |
| Siemens | RUGGEDCOM RST2428P | before V3.1; before V3.2 | V3.1, V3.2 |
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family | before V3.2 | V3.2 |
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family | before V3.1; before V3.2 | V3.1, V3.2 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
| Linux | Linux Kernel | 2.6.32 up to, but not including, 4.19.321; 4.20 up to, but not including, 5.4.283; 5.5 up to, but not including, 5.10.225; 5.11 up to, but not including, 5.15.166; 5.16 up to, but not including, 6.1.107; 6.2 up to, but not including, 6.6.48; 6.7 up to, but not including, 6.10.7; 6.11 | 4.19.321, 5.4.283, 5.10.225, 5.15.166, 6.1.107, 6.6.48 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree. ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/24e93695b1239fbe4c31e224372be77f82dab69a
- git.kernel.org/stable/c/571567e0277008459750f0728f246086b2659429
- git.kernel.org/stable/c/9a3e55afa95ed4ac9eda112d4f918af645d72f25
- git.kernel.org/stable/c/af1dde074ee2ed7dd5bdca4e7e8ba17f44e7b011
- git.kernel.org/stable/c/cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e
- git.kernel.org/stable/c/ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8
- git.kernel.org/stable/c/e44bd76dd072756e674f45c5be00153f4ded68b2
- git.kernel.org/stable/c/faa389b2fbaaec7fd27a390b4896139f9da662e3
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.