In the Linux kernel, the following vulnerability has been resolved:
net: do not delay dstentriesadd() in dst_release()
dstentriesadd() uses per-cpu data that might be freed at netns dismantle from ip6routenetexit() calling dstentries_destroy()
Before ip6routenetexit() can be called, we release all the dsts associated with this netns, via calls to dstrelease(), which waits an rcu grace period before calling dst_destroy()
dstentriesadd() use in dstdestroy() is racy, because dstentries_destroy() could have been called already.
Decrementing the number of dsts must happen sooner.
Notes:
1) in CONFIGXFRM case, dstdestroy() can call dstreleaseimmediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this.
2) There is also discussion about removing this count of dst, which might happen in future kernels.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50036.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50036.json"
[
{
"id": "CVE-2024-50036-020807dd",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@547087307bc19417b4f2bc85ba9664a3e8db5a6a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"278642766512496070546740145902129140321",
"7057712742025224442491977268052916596",
"252102659651587385771038261800216926770",
"324547762521726758560373678146055725627",
"75797274750935554862926903212504262415",
"94019569598149610504669185864877925990",
"129327787759512500909872581412670737818",
"8668098712575541040478369271805179821",
"318459979899850760628527583009321944085",
"250197233897371739196733189985259989938",
"34511738274165695874733708035893866701",
"56480776046047447204716790834726407509",
"314597243017062969207401982984135706631",
"76507989756314186949529434936942833022"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-50036-02d57c1a",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
"digest": {
"function_hash": "203465611944256651979442354490903262522",
"length": 106.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-03fa34ec",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a60db84f772fc3a906c6c4072f9207579c41166f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"107647814039292331136555793883075779982",
"208271631466506595176642441510918868616",
"252102659651587385771038261800216926770",
"324547762521726758560373678146055725627",
"75797274750935554862926903212504262415",
"94019569598149610504669185864877925990",
"129327787759512500909872581412670737818",
"8668098712575541040478369271805179821",
"318459979899850760628527583009321944085",
"250197233897371739196733189985259989938",
"34511738274165695874733708035893866701",
"56480776046047447204716790834726407509",
"314597243017062969207401982984135706631",
"76507989756314186949529434936942833022"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-50036-1a02c502",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3915f028b1f1c37e87542e5aadd33728c259d96",
"digest": {
"function_hash": "327343554572153795771620092360060965475",
"length": 291.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-25c3f64e",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
"digest": {
"function_hash": "246484198373680026858186091367689896410",
"length": 138.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-291d1fea",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
"digest": {
"function_hash": "203465611944256651979442354490903262522",
"length": 106.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-30cf1ff3",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
"digest": {
"function_hash": "246484198373680026858186091367689896410",
"length": 138.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-3a3bc2c4",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a60db84f772fc3a906c6c4072f9207579c41166f",
"digest": {
"function_hash": "327343554572153795771620092360060965475",
"length": 291.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-3fa68f67",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@547087307bc19417b4f2bc85ba9664a3e8db5a6a",
"digest": {
"function_hash": "327343554572153795771620092360060965475",
"length": 291.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-4159f4a7",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac888d58869bb99753e7652be19a151df9ecb35d",
"digest": {
"function_hash": "298294805160729212958344640550871828666",
"length": 588.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-4f739346",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3915f028b1f1c37e87542e5aadd33728c259d96",
"digest": {
"function_hash": "217231857058391961212172215520469165213",
"length": 572.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-65e39f8c",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
"digest": {
"function_hash": "298294805160729212958344640550871828666",
"length": 588.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-86cc1aed",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3915f028b1f1c37e87542e5aadd33728c259d96",
"digest": {
"function_hash": "304170990438112505970970476684135316322",
"length": 269.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-8c51f6eb",
"target": {
"function": "dst_release",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac888d58869bb99753e7652be19a151df9ecb35d",
"digest": {
"function_hash": "246484198373680026858186091367689896410",
"length": 138.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-976d3430",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac888d58869bb99753e7652be19a151df9ecb35d",
"digest": {
"function_hash": "203465611944256651979442354490903262522",
"length": 106.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-9a1fc142",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a60db84f772fc3a906c6c4072f9207579c41166f",
"digest": {
"function_hash": "304170990438112505970970476684135316322",
"length": 269.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-9ad05f79",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
"digest": {
"function_hash": "198723366896529153356953382734916457008",
"length": 597.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-9aec1bb7",
"target": {
"function": "dst_release_immediate",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@547087307bc19417b4f2bc85ba9664a3e8db5a6a",
"digest": {
"function_hash": "304170990438112505970970476684135316322",
"length": 269.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-9c000c10",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a60db84f772fc3a906c6c4072f9207579c41166f",
"digest": {
"function_hash": "198723366896529153356953382734916457008",
"length": 597.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-9d7045ec",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"107647814039292331136555793883075779982",
"208271631466506595176642441510918868616",
"252102659651587385771038261800216926770",
"131752703943139036480082390799795303324",
"99216887332753327387068012525000449948",
"301746215121041742439537929466735982261",
"251470983426657188052087553073769891330",
"161866773643187532966249636160750804024",
"269846957271514999864036560468445550091",
"45208324450398362851970703090311487530",
"74713718472392804051190111784164702817",
"298968828976872748528891518630184705190",
"271445821682405407833576842596401370994",
"191774988470808280646142257231861178913"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-50036-adee367b",
"target": {
"function": "dst_destroy",
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@547087307bc19417b4f2bc85ba9664a3e8db5a6a",
"digest": {
"function_hash": "338327356195090054407687674278099116863",
"length": 592.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-50036-bd1b6f84",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"107647814039292331136555793883075779982",
"208271631466506595176642441510918868616",
"252102659651587385771038261800216926770",
"131752703943139036480082390799795303324",
"99216887332753327387068012525000449948",
"301746215121041742439537929466735982261",
"251470983426657188052087553073769891330",
"161866773643187532966249636160750804024",
"269846957271514999864036560468445550091",
"45208324450398362851970703090311487530",
"74713718472392804051190111784164702817",
"298968828976872748528891518630184705190",
"271445821682405407833576842596401370994",
"191774988470808280646142257231861178913"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-50036-d39ca0e3",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac888d58869bb99753e7652be19a151df9ecb35d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"107647814039292331136555793883075779982",
"208271631466506595176642441510918868616",
"252102659651587385771038261800216926770",
"131752703943139036480082390799795303324",
"99216887332753327387068012525000449948",
"301746215121041742439537929466735982261",
"251470983426657188052087553073769891330",
"161866773643187532966249636160750804024",
"269846957271514999864036560468445550091",
"45208324450398362851970703090311487530",
"74713718472392804051190111784164702817",
"298968828976872748528891518630184705190",
"271445821682405407833576842596401370994",
"191774988470808280646142257231861178913"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-50036-ed8fec0c",
"target": {
"file": "net/core/dst.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3915f028b1f1c37e87542e5aadd33728c259d96",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337273675296456094097199844357200954780",
"30494800674845641095168152035584857860",
"282942107221149280888667900486619114545",
"92959634876851008309464125079583970322",
"115456073535197261320193048003079050080",
"7057712742025224442491977268052916596",
"252102659651587385771038261800216926770",
"324547762521726758560373678146055725627",
"75797274750935554862926903212504262415",
"94019569598149610504669185864877925990",
"129327787759512500909872581412670737818",
"8668098712575541040478369271805179821",
"318459979899850760628527583009321944085",
"250197233897371739196733189985259989938",
"34511738274165695874733708035893866701",
"56480776046047447204716790834726407509",
"314597243017062969207401982984135706631",
"76507989756314186949529434936942833022"
]
},
"signature_type": "Line"
}
]