CVE-2024-45016 (GCVE-0-2024-45016)
Vulnerability from cvelistv5
Published
2024-09-11 15:13
Modified
2026-08-05 11:37
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: 5845f706388a4cde0f6b80f9e5d33527e942b7d9
Version: a550a01b8af856f2684b0f79d552f5119eb5006c
Version: 009510a90e230bb495f3fe25c7db956679263b07
Version: 4de7d30668cb8b06330992e1cd336f91700a2ce7
Version: d1dd2e15c85e890a1cc9bde5ba07ae63331e5c73
Version: 0148fe458b5705e2fea7cb88294fed7e36066ca2
Version: 3.16.66   ≤
Version: 4.9.163   ≤
Version: 4.14.106   ≤
Version: 4.19.28   ≤
Version: 4.20.15   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:49:19.675501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:49:33.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:15:21.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:57:29.260Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_netem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "52d99a69f3d556c6426048c9d481b912205919d8",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "0486d31dd8198e22b63a4730244b38fffce6d469",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "577d6c0619467fe90f7e8e57e45cb5bd9d936014",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "e5bb2988a310667abed66c7d3ffa28880cf0f883",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "lessThan": "c07ff8592d57ed258afee5a5e04991a48dbaf382",
              "status": "affected",
              "version": "5845f706388a4cde0f6b80f9e5d33527e942b7d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a550a01b8af856f2684b0f79d552f5119eb5006c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009510a90e230bb495f3fe25c7db956679263b07",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4de7d30668cb8b06330992e1cd336f91700a2ce7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1dd2e15c85e890a1cc9bde5ba07ae63331e5c73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0148fe458b5705e2fea7cb88294fed7e36066ca2",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.66",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.163",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.106",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.28",
              "versionType": "semver"
            },
            {
              "lessThan": "4.21",
              "status": "affected",
              "version": "4.20.15",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_netem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.283",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.225",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.106",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.20.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetem: fix return value if duplicate enqueue fails\n\nThere is a bug in netem_enqueue() introduced by\ncommit 5845f706388a (\"net: netem: fix skb length BUG_ON in __skb_to_sgvec\")\nthat can lead to a use-after-free.\n\nThis commit made netem_enqueue() always return NET_XMIT_SUCCESS\nwhen a packet is duplicated, which can cause the parent qdisc\u0027s q.qlen\nto be mistakenly incremented. When this happens qlen_notify() may be\nskipped on the parent during destruction, leaving a dangling pointer\nfor some classful qdiscs like DRR.\n\nThere are two ways for the bug happen:\n\n- If the duplicated packet is dropped by rootq-\u003eenqueue() and then\n  the original packet is also dropped.\n- If rootq-\u003eenqueue() sends the duplicated packet to a different qdisc\n  and the original packet is dropped.\n\nIn both cases NET_XMIT_SUCCESS is returned even though no packets\nare enqueued at the netem qdisc.\n\nThe fix is to defer the enqueue of the duplicate packet until after\nthe original packet has been guaranteed to return NET_XMIT_SUCCESS."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by configuring a DRR/netem qdisc hierarchy via rtnetlink (RTM_NEWQDISC/RTM_NEWTCLASS) and locally transmitting packets through it. This requires local system access, matching the tc/netlink qdisc guidance.\nAC:L - The attacker fully controls both trigger conditions \u2014 netem\u0027s `duplicate` probability (settable to 100%) and its `limit` \u2014 so the bogus NET_XMIT_SUCCESS is produced deterministically on every enqueue, with no race to win and no reliance on state outside the attacker\u0027s control.\nPR:L - Qdisc and class configuration requires CAP_NET_ADMIN, but the check is `netlink_net_capable()` against the netns owner user_ns, so any unprivileged user obtains it inside `unshare -Urn` along with a dummy/veth device to attach the qdiscs to.\nUI:N - The attacker performs every step \u2014 qdisc setup, packet transmission, class deletion, and the subsequent dequeue that touches freed memory \u2014 with no victim action required.\nS:U - The corruption occurs in kernel heap memory within the same host security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct drr_class` remains linked in `q-\u003eactive` and is dereferenced on dequeue (`cl-\u003eqdisc-\u003eops-\u003epeek`, `cl-\u003edeficit`), so reclaiming the slab object lets the attacker read arbitrary kernel memory through the attacker-controlled `cl-\u003eqdisc` pointer.\nI:H - The use-after-free yields a write primitive via `list_del`/`list_move_tail` into the freed object and a controlled function-pointer call through `cl-\u003eqdisc-\u003eops-\u003epeek`, which is sufficient for control-flow hijack and privilege escalation.\nA:H - Even without successful exploitation the dangling `drr_class` pointer causes an oops/panic on the next dequeue, and the desynchronized parent q.qlen corrupts scheduler state, reliably crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:41.654Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d"
        },
        {
          "url": "https://git.kernel.org/stable/c/52d99a69f3d556c6426048c9d481b912205919d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0486d31dd8198e22b63a4730244b38fffce6d469"
        },
        {
          "url": "https://git.kernel.org/stable/c/577d6c0619467fe90f7e8e57e45cb5bd9d936014"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5bb2988a310667abed66c7d3ffa28880cf0f883"
        },
        {
          "url": "https://git.kernel.org/stable/c/c07ff8592d57ed258afee5a5e04991a48dbaf382"
        }
      ],
      "title": "netem: fix return value if duplicate enqueue fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45016",
    "datePublished": "2024-09-11T15:13:52.053Z",
    "dateReserved": "2024-08-21T05:34:56.682Z",
    "dateUpdated": "2026-08-05T11:37:41.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:15:21.244Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:57:29.260Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45016\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:49:19.675501Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:49:23.756Z\"}}], \"cna\": {\"title\": \"netem: fix return value if duplicate enqueue fails\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"52d99a69f3d556c6426048c9d481b912205919d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"0486d31dd8198e22b63a4730244b38fffce6d469\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"577d6c0619467fe90f7e8e57e45cb5bd9d936014\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"e5bb2988a310667abed66c7d3ffa28880cf0f883\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5845f706388a4cde0f6b80f9e5d33527e942b7d9\", \"lessThan\": \"c07ff8592d57ed258afee5a5e04991a48dbaf382\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a550a01b8af856f2684b0f79d552f5119eb5006c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"009510a90e230bb495f3fe25c7db956679263b07\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4de7d30668cb8b06330992e1cd336f91700a2ce7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1dd2e15c85e890a1cc9bde5ba07ae63331e5c73\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0148fe458b5705e2fea7cb88294fed7e36066ca2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.16.66\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.163\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.106\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.28\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.20.15\", \"lessThan\": \"4.21\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/sched/sch_netem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.225\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sched/sch_netem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4\"}, {\"url\": \"https://git.kernel.org/stable/c/c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d\"}, {\"url\": \"https://git.kernel.org/stable/c/52d99a69f3d556c6426048c9d481b912205919d8\"}, {\"url\": \"https://git.kernel.org/stable/c/0486d31dd8198e22b63a4730244b38fffce6d469\"}, {\"url\": \"https://git.kernel.org/stable/c/577d6c0619467fe90f7e8e57e45cb5bd9d936014\"}, {\"url\": \"https://git.kernel.org/stable/c/e5bb2988a310667abed66c7d3ffa28880cf0f883\"}, {\"url\": \"https://git.kernel.org/stable/c/c07ff8592d57ed258afee5a5e04991a48dbaf382\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetem: fix return value if duplicate enqueue fails\\n\\nThere is a bug in netem_enqueue() introduced by\\ncommit 5845f706388a (\\\"net: netem: fix skb length BUG_ON in __skb_to_sgvec\\\")\\nthat can lead to a use-after-free.\\n\\nThis commit made netem_enqueue() always return NET_XMIT_SUCCESS\\nwhen a packet is duplicated, which can cause the parent qdisc\u0027s q.qlen\\nto be mistakenly incremented. When this happens qlen_notify() may be\\nskipped on the parent during destruction, leaving a dangling pointer\\nfor some classful qdiscs like DRR.\\n\\nThere are two ways for the bug happen:\\n\\n- If the duplicated packet is dropped by rootq-\u003eenqueue() and then\\n  the original packet is also dropped.\\n- If rootq-\u003eenqueue() sends the duplicated packet to a different qdisc\\n  and the original packet is dropped.\\n\\nIn both cases NET_XMIT_SUCCESS is returned even though no packets\\nare enqueued at the netem qdisc.\\n\\nThe fix is to defer the enqueue of the duplicate packet until after\\nthe original packet has been guaranteed to return NET_XMIT_SUCCESS.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.283\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.225\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.66\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.163\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.106\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.20.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:18.767Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45016\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:18.767Z\", \"dateReserved\": \"2024-08-21T05:34:56.682Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-11T15:13:52.053Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.