In the Linux kernel, the following vulnerability has been resolved:
net: defer final 'struct net' free in netns dismantle
Ilya reported a slab-use-after-free in dst_destroy [1]
Issue is in xfrm6netinit() and xfrm4netinit() :
They copy xfrm[46]dstopstemplate into net->xfrm.xfrm[46]dst_ops.
But net structure might be freed before all the dst callbacks are called. So when dst_destroy() calls later :
if (dst->ops->destroy) dst->ops->destroy(dst);
dst->ops points to the old net->xfrm.xfrm[46]dstops, which has been freed.
See a relevant issue fixed in :
ac888d58869b ("net: do not delay dstentriesadd() in dst_release()")
A fix is to queue the 'struct net' to be freed after one another cleanupnet() round (and existing rcubarrier())
[1]
BUG: KASAN: slab-use-after-free in dstdestroy (net/core/dst.c:112) Read of size 8 at addr ffff8882137ccab0 by task swapper/37/0 Dec 03 05:46:18 kernel: CPU: 37 UID: 0 PID: 0 Comm: swapper/37 Kdump: loaded Not tainted 6.12.0 #67 Hardware name: Red Hat KVM/RHEL, BIOS 1.16.1-1.el9 04/01/2014 Call Trace: <IRQ> dumpstacklvl (lib/dumpstack.c:124) printaddressdescription.constprop.0 (mm/kasan/report.c:378) ? dstdestroy (net/core/dst.c:112) printreport (mm/kasan/report.c:489) ? dstdestroy (net/core/dst.c:112) ? kasanaddrtoslab (mm/kasan/common.c:37) kasanreport (mm/kasan/report.c:603) ? dstdestroy (net/core/dst.c:112) ? rcudobatch (kernel/rcu/tree.c:2567) dstdestroy (net/core/dst.c:112) rcudobatch (kernel/rcu/tree.c:2567) ? _pfxrcudobatch (kernel/rcu/tree.c:2491) ? lockdephardirqsonprepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406) rcucore (kernel/rcu/tree.c:2825) handlesoftirqs (kernel/softirq.c:554) _irqexitrcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637) irqexitrcu (kernel/softirq.c:651) sysvecapictimerinterrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049) </IRQ> <TASK> asmsysvecapictimerinterrupt (./arch/x86/include/asm/idtentry.h:702) RIP: 0010:defaultidle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:743) Code: 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d c7 c9 27 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 RSP: 0018:ffff888100d2fe00 EFLAGS: 00000246 RAX: 00000000001870ed RBX: 1ffff110201a5fc2 RCX: ffffffffb61a3e46 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb3d4d123 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed11c7e1835d R10: ffff888e3f0c1aeb R11: 0000000000000000 R12: 0000000000000000 R13: ffff888100d20000 R14: dffffc0000000000 R15: 0000000000000000 ? ctkernelexit.constprop.0 (kernel/contexttracking.c:148) ? cpuidleidlecall (kernel/sched/idle.c:186) defaultidlecall (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118) cpuidleidlecall (kernel/sched/idle.c:186) ? _pfxcpuidleidlecall (kernel/sched/idle.c:168) ? lockrelease (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5848) ? lockdephardirqsonprepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) ? tscverifytscadjust (arch/x86/kernel/tscsync.c:59) doidle (kernel/sched/idle.c:326) cpustartupentry (kernel/sched/idle.c:423 (discriminator 1)) startsecondary (arch/x86/kernel/smpboot.c:202 arch/x86/kernel/smpboot.c:282) ? _pfxstartsecondary (arch/x86/kernel/smpboot.c:232) ? softrestartcpu (arch/x86/kernel/head64.S:452) commonstartup64 (arch/x86/kernel/head64.S:414) </TASK> Dec 03 05:46:18 kernel: Allocated by task 12184: kasansavestack (mm/kasan/common.c:48) kasansavetrack (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) _kasanslaballoc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmemcacheallocnoprof (mm/slub.c:4085 mm/slub.c:4134 mm/slub.c:4141) copynetns (net/core/netnamespace.c:421 net/core/netnamespace.c:480) createnew_namespaces ---truncated---
[
{
"target": {
"file": "include/net/net_namespace.h"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"80832756634384751402980060169461283365",
"330016090627929250946777674907558795573",
"44590096367827960818906358518397676298"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3267b254dc0a04dfa362a2be24573cfa6d2d78f5",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-0e116454"
},
{
"target": {
"function": "net_free",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 161.0,
"function_hash": "272321369315548408916869957447379657787"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3267b254dc0a04dfa362a2be24573cfa6d2d78f5",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-1038afd1"
},
{
"target": {
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299294855065450173863001524474862728196",
"336780828102311494700427839966116872219",
"50308377101754659915475595649393816291",
"321485117303940205816456813515185426372",
"211972934221183332187354749123781356365",
"132198892457893128361417538337000910320",
"112549649578013184855885795581811087519",
"323970401390092213497740554858611788226",
"290570582144350636986062037381675819558",
"87325517935765295731185481699782631023",
"246631847718168016484247257983767661404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3267b254dc0a04dfa362a2be24573cfa6d2d78f5",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-39ae4a29"
},
{
"target": {
"function": "net_free",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 161.0,
"function_hash": "272321369315548408916869957447379657787"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c261dcd61c9e88a8f1a66654354d32295a975230",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-3a5671fb"
},
{
"target": {
"function": "net_free",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 205.0,
"function_hash": "309012350756757083596165484192087004185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7a79e51297f7b82adb687086f5cb2da446f1e40",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-56b490f7"
},
{
"target": {
"function": "net_free",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 205.0,
"function_hash": "309012350756757083596165484192087004185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f6ede9fbc747e2553612271bce108f7517e7a45",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-5cc904a5"
},
{
"target": {
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299294855065450173863001524474862728196",
"336780828102311494700427839966116872219",
"50308377101754659915475595649393816291",
"267543546524347830501030100239193416643",
"227500243737818567595807803280008590579",
"217408317024187061222840616674109711897",
"323970401390092213497740554858611788226",
"290570582144350636986062037381675819558",
"87325517935765295731185481699782631023",
"246631847718168016484247257983767661404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f6ede9fbc747e2553612271bce108f7517e7a45",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-61532ba3"
},
{
"target": {
"function": "cleanup_net",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 1379.0,
"function_hash": "98148780907226287027818468128652788405"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f6ede9fbc747e2553612271bce108f7517e7a45",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-6586a80d"
},
{
"target": {
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299294855065450173863001524474862728196",
"336780828102311494700427839966116872219",
"50308377101754659915475595649393816291",
"321485117303940205816456813515185426372",
"211972934221183332187354749123781356365",
"132198892457893128361417538337000910320",
"112549649578013184855885795581811087519",
"323970401390092213497740554858611788226",
"290570582144350636986062037381675819558",
"87325517935765295731185481699782631023",
"246631847718168016484247257983767661404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c261dcd61c9e88a8f1a66654354d32295a975230",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-75acbbaa"
},
{
"target": {
"function": "cleanup_net",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 1379.0,
"function_hash": "98148780907226287027818468128652788405"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c261dcd61c9e88a8f1a66654354d32295a975230",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-76cdfa0f"
},
{
"target": {
"function": "cleanup_net",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 1379.0,
"function_hash": "98148780907226287027818468128652788405"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dac465986a4a38cd2f13e934f562b6ca344e5720",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-98c81431"
},
{
"target": {
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299294855065450173863001524474862728196",
"336780828102311494700427839966116872219",
"50308377101754659915475595649393816291",
"321485117303940205816456813515185426372",
"211972934221183332187354749123781356365",
"132198892457893128361417538337000910320",
"112549649578013184855885795581811087519",
"323970401390092213497740554858611788226",
"290570582144350636986062037381675819558",
"87325517935765295731185481699782631023",
"246631847718168016484247257983767661404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dac465986a4a38cd2f13e934f562b6ca344e5720",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-b0832ef6"
},
{
"target": {
"function": "net_free",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 161.0,
"function_hash": "272321369315548408916869957447379657787"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dac465986a4a38cd2f13e934f562b6ca344e5720",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-ba55577c"
},
{
"target": {
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299294855065450173863001524474862728196",
"336780828102311494700427839966116872219",
"50308377101754659915475595649393816291",
"267543546524347830501030100239193416643",
"227500243737818567595807803280008590579",
"217408317024187061222840616674109711897",
"323970401390092213497740554858611788226",
"290570582144350636986062037381675819558",
"87325517935765295731185481699782631023",
"246631847718168016484247257983767661404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7a79e51297f7b82adb687086f5cb2da446f1e40",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-bfa94098"
},
{
"target": {
"file": "include/net/net_namespace.h"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"80832756634384751402980060169461283365",
"330016090627929250946777674907558795573",
"44590096367827960818906358518397676298"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f6ede9fbc747e2553612271bce108f7517e7a45",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-c194b53a"
},
{
"target": {
"function": "cleanup_net",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 1133.0,
"function_hash": "193527011203379039177946473394152595099"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3267b254dc0a04dfa362a2be24573cfa6d2d78f5",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-d1e1f4ac"
},
{
"target": {
"file": "include/net/net_namespace.h"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"80832756634384751402980060169461283365",
"330016090627929250946777674907558795573",
"44590096367827960818906358518397676298"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dac465986a4a38cd2f13e934f562b6ca344e5720",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-e3b84c0c"
},
{
"target": {
"file": "include/net/net_namespace.h"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"80832756634384751402980060169461283365",
"330016090627929250946777674907558795573",
"44590096367827960818906358518397676298"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7a79e51297f7b82adb687086f5cb2da446f1e40",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-f587f12a"
},
{
"target": {
"function": "cleanup_net",
"file": "net/core/net_namespace.c"
},
"signature_version": "v1",
"digest": {
"length": 1133.0,
"function_hash": "193527011203379039177946473394152595099"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7a79e51297f7b82adb687086f5cb2da446f1e40",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56658-f66a2c97"
},
{
"target": {
"file": "include/net/net_namespace.h"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"80832756634384751402980060169461283365",
"330016090627929250946777674907558795573",
"44590096367827960818906358518397676298"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c261dcd61c9e88a8f1a66654354d32295a975230",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56658-ff253cba"
}
]