[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024110939-CVE-2024-50257-af5f@gregkh>
Date: Sat, 9 Nov 2024 11:16:05 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-50257: netfilter: Fix use-after-free in get_info()
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
netfilter: Fix use-after-free in get_info()
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80
Modules linked in: ip6table_nat(-)
CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:module_put+0x6f/0x80
Call Trace:
<TASK>
get_info+0x128/0x180
do_ip6t_get_ctl+0x6a/0x430
nf_getsockopt+0x46/0x80
ipv6_getsockopt+0xb9/0x100
rawv6_getsockopt+0x42/0x190
do_sock_getsockopt+0xaa/0x180
__sys_getsockopt+0x70/0xc0
__x64_sys_getsockopt+0x20/0x30
do_syscall_64+0xa2/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning.
The root cause is as follows:
cpu0 cpu1
module_exit
//mod->state = MODULE_STATE_GOING
ip6table_nat_exit
xt_unregister_template
kfree(t)
//removed from templ_list
getinfo()
t = xt_find_table_lock
list_for_each_entry(tmpl, &xt_templates[af]...)
if (strcmp(tmpl->name, name))
continue; //table not found
try_module_get
list_for_each_entry(t, &xt_net->tables[af]...)
return t; //not get refcnt
module_put(t->me) //uaf
unregister_pernet_subsys
//remove table from xt_net list
While xt_table module was going away and has been removed from
xt_templates list, we couldnt get refcnt of xt_table->me. Check
module in xt_net->tables list re-traversal to fix it.
The Linux kernel CVE team has assigned CVE-2024-50257 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.15 with commit fdacd57c79b7 and fixed in 5.15.171 with commit ba22ea013483
Issue introduced in 5.15 with commit fdacd57c79b7 and fixed in 6.1.116 with commit cb7c388b5967
Issue introduced in 5.15 with commit fdacd57c79b7 and fixed in 6.6.60 with commit 6a1f088f9807
Issue introduced in 5.15 with commit fdacd57c79b7 and fixed in 6.11.7 with commit bab3bb35c03b
Issue introduced in 5.15 with commit fdacd57c79b7 and fixed in 6.12-rc6 with commit f48d258f0ac5
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2024-50257
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/netfilter/x_tables.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749
https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96
https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8
https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b
https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa
Powered by blists - more mailing lists