{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44934", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.664Z", "datePublished": "2024-08-26T10:11:25.809Z", "dateUpdated": "2026-08-05T11:37:07.351Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:07.351Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: wait for previous gc cycles when removing port\n\nsyzbot hit a use-after-free[1] which is caused because the bridge doesn't\nmake sure that all previous garbage has been collected when removing a\nport. What happens is:\n CPU 1 CPU 2\n start gc cycle remove port\n acquire gc lock first\n wait for lock\n call br_multicasg_gc() directly\n acquire lock now but free port\n the port can be freed\n while grp timers still\n running\n\nMake sure all previous gc cycles have finished by using flush_work before\nfreeing the port.\n\n[1]\n BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699\n\n CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n Call Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792\n expire_timers kernel/time/timer.c:1843 [inline]\n __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417\n __run_timer_base kernel/time/timer.c:2428 [inline]\n __run_timer_base kernel/time/timer.c:2421 [inline]\n run_timer_base+0x111/0x190 kernel/time/timer.c:2437" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered only by removing a port from a bridge via local RTNL netlink (`ip link set dev X nomaster`) or the `SIOCBRDELIF` ioctl; received packets alone cannot trigger the port teardown. This requires local system access.\nAC:L - Although this is a race between the mcast gc workqueue and `br_multicast_del_port()`, the attacker drives both sides — populating/expiring port groups to queue gc work while concurrently deleting the port from another CPU — and can retry unboundedly, as demonstrated by the syzbot reproducer.\nPR:L - Bridge creation and port add/remove need only CAP_NET_ADMIN within a network namespace, which any unprivileged user obtains via `unshare -Urn` on default-configured distros; no real root is required.\nUI:N - The attacker performs every step — creating the bridge, generating multicast group state, and removing the port — with no action by any other user.\nS:U - The use-after-free is confined to kernel memory within the same security authority; it does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - The expiring timer reads freed `net_bridge_port` memory (`pg->key.port->br`) and then dereferences that value as a bridge structure; controlling the reclaimed slab yields an arbitrary kernel read primitive and disclosure of kernel memory.\nI:H - After the port slab is reclaimed with attacker-controlled data, the callback performs `spin_lock(&br->multicast_lock)` and structured list/notify operations through the forged pointer, giving controlled kernel writes and a path to control-flow hijack.\nA:H - Even without exploitation the UAF causes a KASAN splat, oops, or panic when the group timer fires against the freed port, crashing the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/br_multicast.c" ], "versions": [ { "version": "e12cec65b5546f19217e26aafb8add6e2fadca18", "lessThan": "1e16828020c674b3be85f52685e8b80f9008f50f", "status": "affected", "versionType": "git" }, { "version": "e12cec65b5546f19217e26aafb8add6e2fadca18", "lessThan": "0d8b26e10e680c01522d7cc14abe04c3265a928f", "status": "affected", "versionType": "git" }, { "version": "e12cec65b5546f19217e26aafb8add6e2fadca18", "lessThan": "e3145ca904fa8dbfd1a5bf0187905bc117b0efce", "status": "affected", "versionType": "git" }, { "version": "e12cec65b5546f19217e26aafb8add6e2fadca18", "lessThan": "b2f794b168cf560682ff976b255aa6d29d14a658", "status": "affected", "versionType": "git" }, { "version": "e12cec65b5546f19217e26aafb8add6e2fadca18", "lessThan": "92c4ee25208d0f35dafc3213cdf355fbe449e078", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/br_multicast.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.105", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.46", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.10.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1e16828020c674b3be85f52685e8b80f9008f50f" }, { "url": "https://git.kernel.org/stable/c/0d8b26e10e680c01522d7cc14abe04c3265a928f" }, { "url": "https://git.kernel.org/stable/c/e3145ca904fa8dbfd1a5bf0187905bc117b0efce" }, { "url": "https://git.kernel.org/stable/c/b2f794b168cf560682ff976b255aa6d29d14a658" }, { "url": "https://git.kernel.org/stable/c/92c4ee25208d0f35dafc3213cdf355fbe449e078" } ], "title": "net: bridge: mcast: wait for previous gc cycles when removing port", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-44934", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:27:51.533304Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:32:55.981Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:13:38.280Z" } } ] } }