CVE-2024-46800

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sch/netem: fix use after free in netem_dequeue

If netem_dequeue() enqueues packet to inner qdisc and that qdisc

returns __NET_XMIT_STOLEN. The packet is dropped but

qdisc_tree_reduce_backlog() is not called to update the parent's

q.qlen, leading to the similar use-after-free as Commit

e04991a48dbaf382 ("netem: fix return value if duplicate enqueue

fails")

Commands to trigger KASAN UaF:

ip link add type dummy

ip link set lo up

ip link set dummy0 up

tc qdisc add dev lo parent root handle 1: drr

tc filter add dev lo parent 1: basic classid 1:1

tc class add dev lo classid 1:1 drr

tc qdisc add dev lo parent 1:1 handle 2: netem

tc qdisc add dev lo parent 2: handle 3: drr

tc filter add dev lo parent 3: basic classid 3:1 action mirred egress

redirect dev dummy0

tc class add dev lo classid 3:1 drr

ping -c1 -W0.01 localhost # Trigger bug

tc class del dev lo classid 1:1

tc class add dev lo classid 1:1 drr

ping -c1 -W0.01 loca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References