In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found as follow in Linux 5.4.
BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: <IRQ> call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20
This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP.
The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers.
This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed.
Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails.
[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-develUpgrade perfUpgrade kernel-livepatch-4.14.262-200.489Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.93-87.444Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-devel | Apr 25, 2024 | Feb 27, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade python-perfUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade perf | Oct 8, 2024 | Feb 27, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-develUpgrade perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade bpftoolUpgrade python-perf | Jul 23, 2024 | Feb 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Jul 17, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade kernel-rtUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-debugUpgrade kernel-source-azureUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-rt-livepatch-develUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade dtb-amazonUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade dtb-qcomUpgrade dtb-alteraUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade dtb-broadcomUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade dtb-marvellUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade kernel-devel-rtUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-armUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade kernel-source-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-optionalUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade reiserfs-kmp-rtUpgrade kernel-debug-develUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade kernel-develUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade kernel-docsUpgrade dtb-allwinnerUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debugUpgrade dtb-rockchipUpgrade dtb-renesasUpgrade dlm-kmp-azure | Aug 9, 2024 | Feb 27, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-4.4.0-1130-awsUpgrade linux-image-4.4.0-253-lowlatencyUpgrade linux-image-4.4.0-1131-kvmUpgrade linux-image-4.4.0-1168-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-awsUpgrade linux-image-4.4.0-253-generic | Apr 22, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub