In the Linux kernel, the following vulnerability has been resolved:
net/sched: Fix UAF when resolving a clash
KASAN reports the following UAF:
BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469
Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1/0xb0 </IRQ> <TASK> asm_common_interrupt+0x27/0x40
Allocated by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_alloc_info+0x1e/0x40 __kasan_krealloc+0x133/0x190 krealloc+0xaa/0x130 nf_ct_ext_add+0xed/0x230 [nf_conntrack] tcf_ct_act+0x1095/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491
Freed by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_free_info+0x2b/0x60 ____kasan_slab_free+0x180/0x1f0 __kasan_slab_free+0x12/0x30 slab_free_freelist_hook+0xd2/0x1a0 __kmem_cache_free+0x1a2/0x2f0 kfree+0x78/0x120 nf_conntrack_free+0x74/0x130 [nf_conntrack] nf_ct_destroy+0xb2/0x140 [nf_conntrack] __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack] nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack] __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack] tcf_ct_act+0x12ad/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491
The ct may be dropped if a clash has been resolved but is still passed to the tcf_ct_flow_table_process_conn function for further usage. This issue can be fixed by retrieving ct from skb again after confirming conntrack.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-develUpgrade bpftoolUpgrade kernel-64kUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade rvUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade libperfUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-docUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-coreUpgrade kernel-64k-debugUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-modules-coreUpgrade kernel-develUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-rt-debug-modules | Sep 26, 2024 | Jul 29, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Aug 14, 2024 | Jul 29, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Jul 29, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Sep 25, 2024 | Jul 29, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-rt-kvmUpgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-devel-matchedUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-tools-libs-develUpgrade perfUpgrade rvUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade libperfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade bpftool-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade rtlaUpgrade kernel-headersUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-debuginfoUpgrade kernel-debug-modules-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-cross-headers | Sep 17, 2024 | Jul 29, 2024 |
| Suse | — | Upgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-rtUpgrade kernel-azure-optionalUpgrade dtb-socionextUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-defaultUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade dtb-allwinnerUpgrade kernel-rt-optionalUpgrade kernel-64kb-develUpgrade dtb-amdUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-marvellUpgrade kernel-default-optionalUpgrade kernel-debug-develUpgrade cluster-md-kmp-rtUpgrade kernel-azure-extraUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade dtb-mediatekUpgrade gfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-develUpgrade dtb-sprdUpgrade dlm-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade dtb-renesasUpgrade ocfs2-kmp-64kbUpgrade kernel-default-baseUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-azureUpgrade dlm-kmp-azureUpgrade dtb-lgUpgrade kernel-azure-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-debug-livepatch-develUpgrade kernel-sourceUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-exynosUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-default-develUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade dlm-kmp-64kbUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-armUpgrade dtb-freescaleUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdso | Aug 14, 2024 | Jul 29, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-intelUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-raspiUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-64kUpgrade linux-image-intel-iotgUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-azureUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-gkeop-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-121-genericUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1069-awsUpgrade linux-image-ibm-classicUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-azure-cvmUpgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-lowlatency | Sep 12, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub