cbcvebase.
CVE-2024-50036
published 2024-10-21

CVE-2024-50036: In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data…

PriorityP428high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.24%
15.2th percentile
In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.

Affected

38 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.119-1 (bookworm)linux 6.1.119-1 (bookworm)
debianlinux-6.1< linux 6.1.119-1 (bookworm)linux 6.1.119-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 3.10.50 < 3.113.11
linuxlinux>= 3.12.26 < 3.133.13
linuxlinux>= 3.14.14 < 3.153.15
linuxlinux>= 3.15.7 < 3.163.16
linuxlinux>= f88649721268999bdff09777847080a52004f691 < 547087307bc19417b4f2bc85ba9664a3e8db5a6a547087307bc19417b4f2bc85ba9664a3e8db5a6a
linuxlinux>= f88649721268999bdff09777847080a52004f691 < e3915f028b1f1c37e87542e5aadd33728c259d96e3915f028b1f1c37e87542e5aadd33728c259d96
linuxlinux>= f88649721268999bdff09777847080a52004f691 < a60db84f772fc3a906c6c4072f9207579c41166fa60db84f772fc3a906c6c4072f9207579c41166f
linuxlinux>= f88649721268999bdff09777847080a52004f691 < eae7435b48ffc8e9be0ff9cfeae40af479a609ddeae7435b48ffc8e9be0ff9cfeae40af479a609dd
linuxlinux>= f88649721268999bdff09777847080a52004f691 < 3c7c918ec0aa3555372c5a57f18780b7a96c5cfc3c7c918ec0aa3555372c5a57f18780b7a96c5cfc
linuxlinux>= f88649721268999bdff09777847080a52004f691 < ac888d58869bb99753e7652be19a151df9ecb35dac888d58869bb99753e7652be19a151df9ecb35d
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.119-16.1.119-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 5.15.0-133.1445.15.0-133.144
linuxlinux_kernel>= 0 < 6.8.0-56.586.8.0-56.58

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.