In the Linux kernel, the following vulnerability has been resolved:
net/sched: Fix UAF when resolving a clash
KASAN reports the following UAF:
BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469
Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1/0xb0 </IRQ> <TASK> asm_common_interrupt+0x27/0x40
Allocated by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_alloc_info+0x1e/0x40 __kasan_krealloc+0x133/0x190 krealloc+0xaa/0x130 nf_ct_ext_add+0xed/0x230 [nf_conntrack] tcf_ct_act+0x1095/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491
Freed by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_free_info+0x2b/0x60 ____kasan_slab_free+0x180/0x1f0 __kasan_slab_free+0x12/0x30 slab_free_freelist_hook+0xd2/0x1a0 __kmem_cache_free+0x1a2/0x2f0 kfree+0x78/0x120 nf_conntrack_free+0x74/0x130 [nf_conntrack] nf_ct_destroy+0xb2/0x140 [nf_conntrack] __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack] nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack] __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack] tcf_ct_act+0x12ad/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491
The ct may be dropped if a clash has been resolved but is still passed to the tcf_ct_flow_table_process_conn function for further usage. This issue can be fixed by retrieving ct from skb again after confirming conntrack.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libperfUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-docUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-rt-modules-coreUpgrade kernel-toolsUpgrade kernel-64k-develUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debugUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-devel-matchedUpgrade kernelUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-64kUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-develUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-coreUpgrade python3-perfUpgrade kernel-64k-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-kvmUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-cross-headers | Sep 26, 2024 | Jul 29, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Aug 14, 2024 | Jul 29, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 16, 2024 | Jul 29, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 25, 2024 | Jul 29, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade libperf-debuginfoUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-develUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-headersUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-debuginfoUpgrade kernel-modules-coreUpgrade rvUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade kernel-tools-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade libperfUpgrade kernel-rt-debuginfoUpgrade kernel-devel-matchedUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade perfUpgrade kernel-tools | Sep 17, 2024 | Jul 29, 2024 |
| Suse | — | Upgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade dlm-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade dtb-rockchipUpgrade dtb-freescaleUpgrade gfs2-kmp-rtUpgrade dtb-lgUpgrade kselftests-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade dtb-armUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade kernel-default-develUpgrade kernel-obs-qaUpgrade cluster-md-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-source-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade gfs2-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade dtb-sprdUpgrade dlm-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-develUpgrade kernel-default-livepatch-develUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-baseUpgrade kernel-azureUpgrade dtb-appleUpgrade kernel-rt_debug-develUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kernel-64kb-devel | Aug 14, 2024 | Jul 29, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-20.04bUpgrade linux-image-intel-iotgUpgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1072-azureUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-gkeUpgrade linux-image-intelUpgrade linux-image-oem-20.04cUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-nvidiaUpgrade linux-image-kvmUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-5.15.0-121-genericUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-ibm-classicUpgrade linux-image-generic-lpaeUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1069-awsUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-ibmUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-awsUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-121-lowlatency | Sep 12, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub