Description

In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0 Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.8 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/1b631bffcb2c09551888f3c723f4365c91fe05ef	Patch
https://git.kernel.org/stable/c/2b82028a1f5ee3a8e04090776b10c534144ae77b	Patch
https://git.kernel.org/stable/c/3a6cd326ead7c8bb1f64486789a01974a9f1ad55	Patch
https://git.kernel.org/stable/c/3af28df0d883e8c89a29ac31bc65f9023485743b	Patch
https://git.kernel.org/stable/c/cb7f811f638a14590ff98f53c6dd1fb54627d940	Patch
https://git.kernel.org/stable/c/ef0394ca25953ea0eddcc82feae1f750451f1876	Patch
https://git.kernel.org/stable/c/ff960f9d3edbe08a736b5a224d91a305ccc946b0	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-416	Use After Free	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 8/28/2024 2:46:29 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 868 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.2 up to (excluding) 5.4.279 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.221 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.162 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.96 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-416
Changed	Reference Type	https://git.kernel.org/stable/c/1b631bffcb2c09551888f3c723f4365c91fe05ef No Types Assigned	https://git.kernel.org/stable/c/1b631bffcb2c09551888f3c723f4365c91fe05ef Patch
Changed	Reference Type	https://git.kernel.org/stable/c/2b82028a1f5ee3a8e04090776b10c534144ae77b No Types Assigned	https://git.kernel.org/stable/c/2b82028a1f5ee3a8e04090776b10c534144ae77b Patch
Changed	Reference Type	https://git.kernel.org/stable/c/3a6cd326ead7c8bb1f64486789a01974a9f1ad55 No Types Assigned	https://git.kernel.org/stable/c/3a6cd326ead7c8bb1f64486789a01974a9f1ad55 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/3af28df0d883e8c89a29ac31bc65f9023485743b No Types Assigned	https://git.kernel.org/stable/c/3af28df0d883e8c89a29ac31bc65f9023485743b Patch
Changed	Reference Type	https://git.kernel.org/stable/c/cb7f811f638a14590ff98f53c6dd1fb54627d940 No Types Assigned	https://git.kernel.org/stable/c/cb7f811f638a14590ff98f53c6dd1fb54627d940 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/ef0394ca25953ea0eddcc82feae1f750451f1876 No Types Assigned	https://git.kernel.org/stable/c/ef0394ca25953ea0eddcc82feae1f750451f1876 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/ff960f9d3edbe08a736b5a224d91a305ccc946b0 No Types Assigned	https://git.kernel.org/stable/c/ff960f9d3edbe08a736b5a224d91a305ccc946b0 Patch

New CVE Received by NIST 7/12/2024 9:15:17 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3227 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 4
Added	Reference		kernel.org https://git.kernel.org/stable/c/1b631bffcb2c09551888f3c723f4365c91fe05ef [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/2b82028a1f5ee3a8e04090776b10c534144ae77b [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/3a6cd326ead7c8bb1f64486789a01974a9f1ad55 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/3af28df0d883e8c89a29ac31bc65f9023485743b [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/cb7f811f638a14590ff98f53c6dd1fb54627d940 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/ef0394ca25953ea0eddcc82feae1f750451f1876 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/ff960f9d3edbe08a736b5a224d91a305ccc946b0 [No types assigned]