In the Linux kernel, the following vulnerability has been resolved:
net/sched: Fix UAF when resolving a clash
KASAN reports the following UAF:
BUG: KASAN: slab-use-after-free in tcfctflowtableprocessconn+0x12b/0x380 [actct] Read of size 1 at addr ffff888c07603600 by task handler130/6469
Call Trace: <IRQ> dumpstacklvl+0x48/0x70 printaddressdescription.constprop.0+0x33/0x3d0 printreport+0xc0/0x2b0 kasanreport+0xd0/0x120 _asanload1+0x6c/0x80 tcfctflowtableprocessconn+0x12b/0x380 [actct] tcfctact+0x886/0x1350 [actct] tcfactionexec+0xf8/0x1f0 flclassify+0x355/0x360 [clsflower] _tcfclassify+0x1fd/0x330 tcfclassify+0x21c/0x3c0 schhandleingress.constprop.0+0x2c5/0x500 _netifreceiveskbcore.constprop.0+0xb25/0x1510 _netifreceiveskblistcore+0x220/0x4c0 netifreceiveskblistinternal+0x446/0x620 napicompletedone+0x157/0x3d0 grocellpoll+0xcf/0x100 _napipoll+0x65/0x310 netrxaction+0x30c/0x5c0 _dosoftirq+0x14f/0x491 _irqexitrcu+0x82/0xc0 irqexitrcu+0xe/0x20 commoninterrupt+0xa1/0xb0 </IRQ> <TASK> asmcommon_interrupt+0x27/0x40
Allocated by task 6469: kasansavestack+0x38/0x70 kasansettrack+0x25/0x40 kasansaveallocinfo+0x1e/0x40 _kasankrealloc+0x133/0x190 krealloc+0xaa/0x130 nfctextadd+0xed/0x230 [nfconntrack] tcfctact+0x1095/0x1350 [actct] tcfactionexec+0xf8/0x1f0 flclassify+0x355/0x360 [clsflower] _tcfclassify+0x1fd/0x330 tcfclassify+0x21c/0x3c0 schhandleingress.constprop.0+0x2c5/0x500 _netifreceiveskbcore.constprop.0+0xb25/0x1510 _netifreceiveskblistcore+0x220/0x4c0 netifreceiveskblistinternal+0x446/0x620 napicompletedone+0x157/0x3d0 grocellpoll+0xcf/0x100 _napipoll+0x65/0x310 netrxaction+0x30c/0x5c0 _dosoftirq+0x14f/0x491
Freed by task 6469: kasansavestack+0x38/0x70 kasansettrack+0x25/0x40 kasansavefreeinfo+0x2b/0x60 __kasanslabfree+0x180/0x1f0 _kasanslabfree+0x12/0x30 slabfreefreelisthook+0xd2/0x1a0 _kmemcachefree+0x1a2/0x2f0 kfree+0x78/0x120 nfconntrackfree+0x74/0x130 [nfconntrack] nfctdestroy+0xb2/0x140 [nfconntrack] _nfctresolveclash+0x529/0x5d0 [nfconntrack] nfctresolveclash+0xf6/0x490 [nfconntrack] _nfconntrackconfirm+0x2c6/0x770 [nfconntrack] tcfctact+0x12ad/0x1350 [actct] tcfactionexec+0xf8/0x1f0 flclassify+0x355/0x360 [clsflower] _tcfclassify+0x1fd/0x330 tcfclassify+0x21c/0x3c0 schhandleingress.constprop.0+0x2c5/0x500 _netifreceiveskbcore.constprop.0+0xb25/0x1510 _netifreceiveskblistcore+0x220/0x4c0 netifreceiveskblistinternal+0x446/0x620 napicompletedone+0x157/0x3d0 grocellpoll+0xcf/0x100 _napipoll+0x65/0x310 netrxaction+0x30c/0x5c0 _dosoftirq+0x14f/0x491
The ct may be dropped if a clash has been resolved but is still passed to the tcfctflowtableprocess_conn function for further usage. This issue can be fixed by retrieving ct from skb again after confirming conntrack.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef472cc6693b16b202a916482df72f35d94bd69e",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-42a5b5a2",
"target": {
"file": "net/sched/act_ct.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"263679616646070997648372652370993326483",
"98387260682802958870229729847807352240",
"96756702632575246475595781925216901178",
"261858123826599707163418555583216660280"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e71b10a100861fb27d9c5755dfd68f615629fae",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-42d28e5b",
"target": {
"file": "net/sched/act_ct.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"263679616646070997648372652370993326483",
"98387260682802958870229729847807352240",
"96756702632575246475595781925216901178",
"261858123826599707163418555583216660280"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e71b10a100861fb27d9c5755dfd68f615629fae",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-57223011",
"target": {
"function": "tcf_ct_act",
"file": "net/sched/act_ct.c"
},
"signature_type": "Function",
"digest": {
"length": 2378.0,
"function_hash": "8328880841852621954199125105075659"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81a523d54ea689414f67c9fb81a5b917a41ed55",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-94c91be9",
"target": {
"function": "tcf_ct_act",
"file": "net/sched/act_ct.c"
},
"signature_type": "Function",
"digest": {
"length": 2195.0,
"function_hash": "266701617900464938158614406608390408245"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@799a34901b634008db4a7ece3900e2b971d4c932",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-98834725",
"target": {
"file": "net/sched/act_ct.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"263679616646070997648372652370993326483",
"98387260682802958870229729847807352240",
"96756702632575246475595781925216901178",
"261858123826599707163418555583216660280"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81a523d54ea689414f67c9fb81a5b917a41ed55",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-a717fedc",
"target": {
"file": "net/sched/act_ct.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"177138492745797251840437053897853402750",
"303068902360109405871809506934214092231",
"96756702632575246475595781925216901178",
"261858123826599707163418555583216660280"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef472cc6693b16b202a916482df72f35d94bd69e",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-e259803e",
"target": {
"function": "tcf_ct_act",
"file": "net/sched/act_ct.c"
},
"signature_type": "Function",
"digest": {
"length": 2730.0,
"function_hash": "81880323999172232215075924721062244618"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@799a34901b634008db4a7ece3900e2b971d4c932",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-41040-fa0a2671",
"target": {
"function": "tcf_ct_act",
"file": "net/sched/act_ct.c"
},
"signature_type": "Function",
"digest": {
"length": 2730.0,
"function_hash": "81880323999172232215075924721062244618"
}
}
]