CVE-2024-46800 sch/netem: fix use after free in netem_dequeue
A use-after-free vulnerability in the Linux kernel's netem scheduler allows local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46800?
CVE-2024-46800 is a high-severity use after free vulnerability in Linux kernel, published on 18 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sch/netem: fix use after free in netem_dequeue
If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails")
Commands to trigger KASAN UaF:
ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF
Weakness: CWE-416
Which versions are affected by CVE-2024-46800?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46800?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-46800 being exploited?
There is no known exploitation of CVE-2024-46800 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49380, BELL-CVE-2024-46800, DEBIAN-CVE-2024-46800, GHSA-gwcv-998j-qccx, UBUNTU-CVE-2024-46800.