CVE - CVE-2024-50036

CVE-ID
CVE-2024-50036	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc URL:https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc MISC:https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a URL:https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a MISC:https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f URL:https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f MISC:https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d URL:https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d MISC:https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96 URL:https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96 MISC:https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd URL:https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd
Assigning CNA
kernel.org
Date Record Created
20241021	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241021)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)