CVE-2024-50257
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-50257
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50257.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-50257
- Downstream
- Related
- Published
- 2024-11-09T10:15:10Z
- Modified
- 2025-10-22T06:15:07.483840Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- netfilter: Fix use-after-free in get_info()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
netfilter: Fix use-after-free in get_info()
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 moduleput+0x6f/0x80 Modules linked in: ip6tablenat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:moduleput+0x6f/0x80 Call Trace: <TASK> getinfo+0x128/0x180 doip6tgetctl+0x6a/0x430 nfgetsockopt+0x46/0x80 ipv6getsockopt+0xb9/0x100 rawv6getsockopt+0x42/0x190 dosockgetsockopt+0xaa/0x180 _sysgetsockopt+0x70/0xc0 _x64sysgetsockopt+0x20/0x30 dosyscall64+0xa2/0x1a0 entrySYSCALL64after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows:
cpu0 cpu1 moduleexit //mod->state = MODULESTATEGOING ip6tablenatexit xtunregistertemplate kfree(t) //removed from templlist getinfo() t = xtfindtablelock listforeachentry(tmpl, &xttemplates[af]...) if (strcmp(tmpl->name, name)) continue; //table not found trymoduleget listforeachentry(t, &xtnet->tables[af]...) return t; //not get refcnt moduleput(t->me) //uaf unregisterpernetsubsys //remove table from xt_net list
While xttable module was going away and has been removed from xttemplates list, we couldnt get refcnt of xttable->me. Check module in xtnet->tables list re-traversal to fix it.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8
- https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749
- https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b
- https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96
- https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfdacd57c79b79a03c7ca88f706ad9fb7b46831c1Fixedba22ea01348384df19cc1fabc7964be6e7189749
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfdacd57c79b79a03c7ca88f706ad9fb7b46831c1Fixedcb7c388b5967946f097afdb759b7c860305f2d96
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfdacd57c79b79a03c7ca88f706ad9fb7b46831c1Fixed6a1f088f9807f5166f58902d26246d0b88da03a8
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfdacd57c79b79a03c7ca88f706ad9fb7b46831c1Fixedbab3bb35c03b263c486833d50d50c081d9e9832b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedfdacd57c79b79a03c7ca88f706ad9fb7b46831c1Fixedf48d258f0ac540f00fa617dac496c4c18b5dc2fa