{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50130", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.955Z", "datePublished": "2024-11-05T17:10:56.344Z", "dateUpdated": "2026-08-05T11:41:55.252Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:55.252Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: must hold reference on net namespace\n\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\nbpf_nf_link_release+0xda/0x1e0\nbpf_link_free+0x139/0x2d0\nbpf_link_release+0x68/0x80\n__fput+0x414/0xb60\n\nEric says:\n It seems that bpf was able to defer the __nf_unregister_net_hook()\n after exit()/close() time.\n Perhaps a netns reference is missing, because the netns has been\n dismantled/freed already.\n bpf_nf_link_attach() does :\n link->net = net;\n But I do not see a reference being taken on net.\n\nAdd such a reference and release it after hook unreg.\nNote that I was unable to get syzbot reproducer to work, so I\ndo not know if this resolves this splat." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only entry point is the `bpf(BPF_LINK_CREATE)` syscall combined with `unshare(CLONE_NEWNET)`/`setns()` and `close()` of the link fd, all of which require an executing context on the local machine. No network peer, adjacent-network frame, or physical bus is involved in triggering the dangling `link->net`.\nAC:L - The attacker performs every step of the sequence themselves — create the netns, attach the link, drop the last netns reference, wait for `cleanup_net()` to free the `struct net`, then close the fd — with no race against another party and no unpredictable precondition. Heap grooming of the `net_namespace` cache is done by the attacker's own repeated namespace creation, and the trigger can be repeated arbitrarily.\nPR:L - Reaching `bpf_nf_link_attach()` needs only `CAP_BPF` plus `CAP_NET_ADMIN` at prog-load time, and `bpf_token_capable()` falls back to `ns_capable(token->userns, ...)`, so a delegated bpffs BPF token — the mechanism built expressly for containers — grants it to an unprivileged user-namespace process; netns creation itself needs only `ns_capable(CAP_SYS_ADMIN)` via `unshare -Ur`. These are non-root, delegable capabilities commonly held by ordinary observability/networking daemons, consistent with kernel CNA precedent for CAP_BPF-gated bugs.\nUI:N - The attacking process creates the namespace, attaches the link, releases the namespace and closes the descriptor entirely within its own context. No victim needs to mount, open, configure, or click anything.\nS:U - The use-after-free occurs in kernel memory and the resulting corruption is confined to the kernel's own security authority on the same host. No hypervisor, IOMMU, or VM boundary is crossed.\nC:H - This is a slab use-after-free on `struct net` — KASAN reports an 8-byte read of freed memory in `__nf_unregister_net_hook()`, and the stale `nf_hook_entries` pointer it yields is then walked and copied by `__nf_hook_entries_try_shrink()` into a fresh allocation. With the freed object reclaimed under attacker-controlled content this becomes a controlled read of arbitrary kernel memory, and it also leaks kernel text/heap addresses of adjacent namespace state.\nI:H - After the freed `struct net` is reallocated, `nf_remove_net_hook()` writes `accept_all` and `&dummy_ops` — known kernel addresses — through a pointer and index taken from attacker-groomed memory, and `bpf_nf_disable_defrag()` decrements/zeroes `net->nf.defrag_ipv4_users` in the freed object. That is a write primitive at an attacker-influenced address, sufficient to corrupt another namespace's netfilter hook table or to build control-flow hijack toward privilege escalation.\nA:H - Even without exploitation the bug is a confirmed KASAN slab-use-after-free that dereferences freed and possibly reused memory in `__nf_unregister_net_hook()`, trips `WARN_ON_ONCE(!p)`/`WARN_ONCE(1, \"hook not found\")`, and readily oopses or panics the kernel. It also leaks the entire `nf_hook_entries` blob of every torn-down namespace, and can be repeated in a loop to reliably crash the host." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_bpf_link.c" ], "versions": [ { "version": "84601d6ee68ae820dec97450934797046d62db4b", "lessThan": "f41bd93b3e0508edc7ba820357f949071dcc0acc", "status": "affected", "versionType": "git" }, { "version": "84601d6ee68ae820dec97450934797046d62db4b", "lessThan": "d0d7939543a1b3bb93af9a18d258a774daf8f162", "status": "affected", "versionType": "git" }, { "version": "84601d6ee68ae820dec97450934797046d62db4b", "lessThan": "1230fe7ad3974f7bf6c78901473e039b34d4fb1f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_bpf_link.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.59", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.6", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.59" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.11.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc" }, { "url": "https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162" }, { "url": "https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f" } ], "title": "netfilter: bpf: must hold reference on net namespace", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50130", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-03-06T16:08:04.815447Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T16:14:33.332Z" } } ] } }