CVE-2024-50036

Vulnerability Summary

Race Condition Patch in Linux Kernel's Network Subsystem

The Linux kernel had a vulnerability which is now fixed. It was related to net: do not delay dst_entries_add() in dst_release(). The problem occurred because dst_entries_add() used per-cpu data, which might be freed during network namespace dismantle from ip6_route_net_exit() calling dst_entries_destroy(). Before ip6_route_net_exit() runs, all dsts linked to the netns are released by calling dst_release(). This waits for an RCU grace period before executing dst_destroy(). The usage of dst_entries_add() in dst_destroy() was problematic because dst_entries_destroy() might have been called already. Decrementing the number of dsts needed to happen earlier. Some points to note are: 1) In the CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child). This can also potentially cause use-after-free if the child doesn’t have DST_NOCOUNT set. IPSEC maintainers could examine this for solutions. 2) There is a conversation about possibly removing this dst count, which could occur in future kernel versions.

Vendor Advisories

References