VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2024/26xxx/CVE-2024-26852.json
T

542 lines
30 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"cveMetadata": {
"cveId": "CVE-2024-26852",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2024-02-19T14:20:24.183Z",
"datePublished": "2024-04-17T10:17:15.923Z",
"dateUpdated": "2026-10-15T00:38:46.362Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T11:27:48.147Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\n\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\n\nCommit f7225172f25a (\"net/ipv6: prevent use after free in\nip6_route_mpath_notify\") was not able to fix the root cause.\n\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\n\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\n\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x167/0x540 mm/kasan/report.c:488\n kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n </TASK>\n\nAllocated by task 23037:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n kasan_kmalloc include/linux/kasan.h:211 [inline]\n __do_kmalloc_node mm/slub.c:3981 [inline]\n __kmalloc+0x22e/0x490 mm/slub.c:3994\n kmalloc include/linux/slab.h:594 [inline]\n kzalloc include/linux/slab.h:711 [inline]\n fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nFreed by task 16:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n poison_slab_object+0xa6/0xe0 m\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by an RTM_NEWROUTE message sent over an AF_NETLINK/NETLINK_ROUTE socket via sendmsg(), which requires local access to the system. There is no remote packet-processing path into ip6_route_multipath_add().\nAC:L - The attacker creates both sides of the condition: they drop the last reference themselves and can widen the window arbitrarily by supplying many nexthops, by setting RTA_EXPIRES=0 so the non-rtnl gc softirq reaps the route, and by lowering net.ipv6.route.gc_interval inside their own netns, with unlimited retries. syzbot reproduced it, confirming reliable triggerability.\nPR:L - rtnetlink_rcv_msg() only requires netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the network namespace's user namespace, so any unprivileged local user obtains it with `unshare -Urn`. Multipath ECMP routes are addable in that namespace using RTNH_F_ONLINK gateways, which bypasses gateway reachability validation.\nUI:N - The entire sequence is performed by the attacker's own process in a single netlink transaction; no victim action, mount, or other interaction is needed.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - rt6_fill_node() reads the freed kmalloc-512 fib6_info and copies its contents into an RTM_NEWROUTE netlink message returned to the attacker's socket, including dereferencing pointers taken from freed memory such as rt->fib6_metrics (passed to rtnetlink_put_metrics()), rt->fib6_table, and rt->fib6_nh. Reclaiming the freed slot with controlled data turns this into an arbitrary kernel-memory read leaked directly to userspace.\nI:H - This is a use-after-free on a 512-byte kmalloc object that an unprivileged attacker can spray and reclaim, after which the kernel dereferences attacker-controlled pointers and performs a list_for_each_entry_safe() walk over the freed fib6_siblings list head. That yields controlled pointer traversal and corruption suitable for privilege escalation.\nA:H - The KASAN slab-use-after-free in rt6_fill_node() causes an oops/panic when the freed object is unmapped, poisoned, or reclaimed with invalid pointers, and it can be triggered repeatedly to reliably crash the kernel."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/ipv6/route.c"
],
"versions": [
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "31ea5bcc7d4cd1423de6be327a2c034725704136",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "664f9c647260cc9d68b4e31d9899530d89dd045e",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "79ce2e54cc0ae366f45516c00bf1b19aa43e9abe",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "cae3303257950d03ffec2df4a45e836f10d26c24",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "394334fe2ae3b9f1e2332b873857e84cb28aac18",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "ed883060c38721ed828061f6c0c30e5147326c9a",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda",
"status": "affected",
"versionType": "git"
},
{
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "685f7d531264599b3f167f1e94bbd22f120e5fab",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/ipv6/route.c"
],
"versions": [
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.11",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "4.19.310",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.4.272",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.213",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.152",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.82",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.22",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.7.10",
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.8",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "4.19.310"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "5.4.272"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "5.10.213"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "5.15.152"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.1.82"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.6.22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.7.10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.8"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136"
},
{
"url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e"
},
{
"url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe"
},
{
"url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24"
},
{
"url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18"
},
{
"url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a"
},
{
"url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda"
},
{
"url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab"
}
],
"title": "net/ipv6: avoid possible UAF in ip6_route_mpath_notify()",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-02T00:14:13.699Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
"tags": [
"x_transferred"
]
}
]
},
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-416",
"lang": "en",
"description": "CWE-416 Use After Free"
}
]
}
],
"affected": [
{
"vendor": "linux",
"product": "linux_kernel",
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "31ea5bcc7d4c",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "664f9c647260",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "79ce2e54cc0a",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "cae330325795",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "394334fe2ae3",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "ed883060c387",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "61b34f73cdbd",
"versionType": "custom"
},
{
"version": "3b1137fe7482",
"status": "affected",
"lessThan": "685f7d531264",
"versionType": "custom"
},
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"lessThan": "4.11",
"versionType": "custom"
},
{
"version": "4.19.310",
"status": "unaffected",
"lessThanOrEqual": "4.20",
"versionType": "custom"
},
{
"version": "5.4.272",
"status": "unaffected",
"lessThanOrEqual": "5.5",
"versionType": "custom"
},
{
"version": "5.10.213",
"status": "unaffected",
"lessThanOrEqual": "5.11",
"versionType": "custom"
},
{
"version": "5.15.152",
"status": "unaffected",
"lessThanOrEqual": "5.16",
"versionType": "custom"
},
{
"version": "6.1.82",
"status": "unaffected",
"lessThanOrEqual": "6.2",
"versionType": "custom"
},
{
"version": "6.6.22",
"status": "unaffected",
"lessThanOrEqual": "6.7",
"versionType": "custom"
},
{
"version": "6.7.10",
"status": "unaffected",
"lessThanOrEqual": "6.8",
"versionType": "custom"
},
{
"version": "6.8",
"status": "unaffected",
"lessThanOrEqual": "*",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2024-04-19T20:41:29.771297Z",
"id": "CVE-2024-26852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-02-11T21:48:49.822Z"
}
},
{
"x_adpType": "supplier",
"providerMetadata": {
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP",
"dateUpdated": "2026-10-15T00:38:46.362Z"
},
"affected": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V1.1.1",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
}
]
}
]
},
"dataVersion": "5.2"
}
View Git Blame Copy Permalink