CVE-2024-50130 (GCVE-0-2024-50130)
Vulnerability from cvelistv5
Published
2024-11-05 17:10
Modified
2026-08-05 11:41
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric says: It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpf_nf_link_attach() does : link->net = net; But I do not see a reference being taken on net. Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.
References
Impacted products
Vendor Product Version
Linux Linux Version: 84601d6ee68ae820dec97450934797046d62db4b
Version: 84601d6ee68ae820dec97450934797046d62db4b
Version: 84601d6ee68ae820dec97450934797046d62db4b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T16:08:04.815447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T16:14:33.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f41bd93b3e0508edc7ba820357f949071dcc0acc",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "d0d7939543a1b3bb93af9a18d258a774daf8f162",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "1230fe7ad3974f7bf6c78901473e039b34d4fb1f",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: must hold reference on net namespace\n\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\nbpf_nf_link_release+0xda/0x1e0\nbpf_link_free+0x139/0x2d0\nbpf_link_release+0x68/0x80\n__fput+0x414/0xb60\n\nEric says:\n It seems that bpf was able to defer the __nf_unregister_net_hook()\n after exit()/close() time.\n Perhaps a netns reference is missing, because the netns has been\n dismantled/freed already.\n bpf_nf_link_attach() does :\n link-\u003enet = net;\n But I do not see a reference being taken on net.\n\nAdd such a reference and release it after hook unreg.\nNote that I was unable to get syzbot reproducer to work, so I\ndo not know if this resolves this splat."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is the `bpf(BPF_LINK_CREATE)` syscall combined with `unshare(CLONE_NEWNET)`/`setns()` and `close()` of the link fd, all of which require an executing context on the local machine. No network peer, adjacent-network frame, or physical bus is involved in triggering the dangling `link-\u003enet`.\nAC:L - The attacker performs every step of the sequence themselves \u2014 create the netns, attach the link, drop the last netns reference, wait for `cleanup_net()` to free the `struct net`, then close the fd \u2014 with no race against another party and no unpredictable precondition. Heap grooming of the `net_namespace` cache is done by the attacker\u0027s own repeated namespace creation, and the trigger can be repeated arbitrarily.\nPR:L - Reaching `bpf_nf_link_attach()` needs only `CAP_BPF` plus `CAP_NET_ADMIN` at prog-load time, and `bpf_token_capable()` falls back to `ns_capable(token-\u003euserns, ...)`, so a delegated bpffs BPF token \u2014 the mechanism built expressly for containers \u2014 grants it to an unprivileged user-namespace process; netns creation itself needs only `ns_capable(CAP_SYS_ADMIN)` via `unshare -Ur`. These are non-root, delegable capabilities commonly held by ordinary observability/networking daemons, consistent with kernel CNA precedent for CAP_BPF-gated bugs.\nUI:N - The attacking process creates the namespace, attaches the link, releases the namespace and closes the descriptor entirely within its own context. No victim needs to mount, open, configure, or click anything.\nS:U - The use-after-free occurs in kernel memory and the resulting corruption is confined to the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or VM boundary is crossed.\nC:H - This is a slab use-after-free on `struct net` \u2014 KASAN reports an 8-byte read of freed memory in `__nf_unregister_net_hook()`, and the stale `nf_hook_entries` pointer it yields is then walked and copied by `__nf_hook_entries_try_shrink()` into a fresh allocation. With the freed object reclaimed under attacker-controlled content this becomes a controlled read of arbitrary kernel memory, and it also leaks kernel text/heap addresses of adjacent namespace state.\nI:H - After the freed `struct net` is reallocated, `nf_remove_net_hook()` writes `accept_all` and `\u0026dummy_ops` \u2014 known kernel addresses \u2014 through a pointer and index taken from attacker-groomed memory, and `bpf_nf_disable_defrag()` decrements/zeroes `net-\u003enf.defrag_ipv4_users` in the freed object. That is a write primitive at an attacker-influenced address, sufficient to corrupt another namespace\u0027s netfilter hook table or to build control-flow hijack toward privilege escalation.\nA:H - Even without exploitation the bug is a confirmed KASAN slab-use-after-free that dereferences freed and possibly reused memory in `__nf_unregister_net_hook()`, trips `WARN_ON_ONCE(!p)`/`WARN_ONCE(1, \"hook not found\")`, and readily oopses or panics the kernel. It also leaks the entire `nf_hook_entries` blob of every torn-down namespace, and can be repeated in a loop to reliably crash the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:55.252Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162"
        },
        {
          "url": "https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f"
        }
      ],
      "title": "netfilter: bpf: must hold reference on net namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50130",
    "datePublished": "2024-11-05T17:10:56.344Z",
    "dateReserved": "2024-10-21T19:36:19.955Z",
    "dateUpdated": "2026-08-05T11:41:55.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50130\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-06T16:08:04.815447Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-06T16:08:06.703Z\"}}], \"cna\": {\"title\": \"netfilter: bpf: must hold reference on net namespace\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"f41bd93b3e0508edc7ba820357f949071dcc0acc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"d0d7939543a1b3bb93af9a18d258a774daf8f162\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"1230fe7ad3974f7bf6c78901473e039b34d4fb1f\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/nf_bpf_link.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_bpf_link.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc\"}, {\"url\": \"https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162\"}, {\"url\": \"https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: bpf: must hold reference on net namespace\\n\\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\\nbpf_nf_link_release+0xda/0x1e0\\nbpf_link_free+0x139/0x2d0\\nbpf_link_release+0x68/0x80\\n__fput+0x414/0xb60\\n\\nEric says:\\n It seems that bpf was able to defer the __nf_unregister_net_hook()\\n after exit()/close() time.\\n Perhaps a netns reference is missing, because the netns has been\\n dismantled/freed already.\\n bpf_nf_link_attach() does :\\n link-\u003enet = net;\\n But I do not see a reference being taken on net.\\n\\nAdd such a reference and release it after hook unreg.\\nNote that I was unable to get syzbot reproducer to work, so I\\ndo not know if this resolves this splat.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:46:49.610Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50130\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:46:49.610Z\", \"dateReserved\": \"2024-10-21T19:36:19.955Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-05T17:10:56.344Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.