CVE-2024-41010

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix too early release of tcx_entry

Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported

an issue that the tcx_entry can be released too early leading to a use

after free (UAF) when an active old-style ingress or clsact qdisc with a

shared tc block is later replaced by another ingress or clsact instance.

Essentially, the sequence to trigger the UAF (one example) can be as follows:

1. A network namespace is created

2. An ingress qdisc is created. This allocates a tcx_entry, and

&tcx_entry->miniq is stored in the qdisc's miniqp->p_miniq. At the

same time, a tcf block with index 1 is created.

3. chain0 is attached to the tcf block. chain0 must be connected to

the block linked to the ingress qdisc to later reach the function

tcf_chain0_head_change_cb_del() which triggers the UAF.

4. Create and graft a clsact qdisc. This causes the ingress qdisc

created in step

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References