CVE-2024-50257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: Fix use-after-free in get_info()

ip6table_nat module unload has refcnt warning for UAF. call trace is:

WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80

Modules linked in: ip6table_nat(-)

CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),

BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

RIP: 0010:module_put+0x6f/0x80

Call Trace:

<TASK>

get_info+0x128/0x180

do_ip6t_get_ctl+0x6a/0x430

nf_getsockopt+0x46/0x80

ipv6_getsockopt+0xb9/0x100

rawv6_getsockopt+0x42/0x190

do_sock_getsockopt+0xaa/0x180

__sys_getsockopt+0x70/0xc0

__x64_sys_getsockopt+0x20/0x30

do_syscall_64+0xa2/0x1a0

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Concurrent execution of module unload and get_info() trigered the warning.

The root cause is as follows:

cpu0 cpu1

module_exit

//mod->state = MO

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References