Critical Vulnerability in Linux Kernel: Netfilter BPF Reference Issue
Summary
DEBIAN-CVE-2024-50130: In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff88... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the netfilter subsystem, which is responsible for packet filtering, network address translation, and other networking-related tasks. The specific issue arises from a failure to maintain a reference to the network namespace, potentially leading to a use-after-free condition.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netfilter subsystem related to the BPF (Berkeley Packet Filter). The issue occurs when the __nf_unregister_net_hook function is called after the network namespace has been dismantled, leading to a slab-use-after-free condition. This can result in unexpected behavior, including potential system crashes or security breaches, as the memory that is accessed may have been freed and repurposed for other uses. The root cause is a missing reference to the network namespace, which allows the BPF to defer the unregistration process beyond the safe lifecycle of the network namespace.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's netfilter subsystem poses a significant risk due to a use-after-free condition. Users are strongly advised to update their systems to the latest patched version to mitigate potential security threats. Regular monitoring and updating of open-source components are crucial for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a use-after-free condition in the Linux kernel's netfilter subsystem, specifically related to the BPF.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Exploiting this vulnerability could lead to system crashes, unauthorized access, or other security breaches due to improper memory handling.
Yes, a patch has been released in version 6.11.6-1 of the Linux kernel. Users should update to this version to mitigate the risk.
System administrators should prioritize updating the Linux kernel to the patched version as soon as possible to protect their systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
