CVE-2024-41010: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2024-41010

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use after free (UAF) when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by another ingress or clsact instance. Essentially, the sequence to trigger the UAF (one example) can be as follows: 1. A network namespace is created 2. An ingress qdisc is created. This allocates a tcx_entry, and &tcx_entry->miniq is stored in the qdisc's miniqp->p_miniq. At the same time, a tcf block with index 1 is created. 3. chain0 is attached to the tcf block. chain0 must be connected to the block linked to the ingress qdisc to later reach the function tcf_chain0_head_change_cb_del() which triggers the UAF. 4. Create and graft a clsact qdisc. This causes the ingress qdisc created in step 1 to be removed, thus freeing the previously linked tcx_entry: rtnetlink_rcv_msg() => tc_modify_qdisc() => qdisc_create() => clsact_init() [a] => qdisc_graft() => qdisc_destroy() => __qdisc_destroy() => ingress_destroy() [b] => tcx_entry_free() => kfree_rcu() // tcx_entry freed 5. Finally, the network namespace is closed. This registers the cleanup_net worker, and during the process of releasing the remaining clsact qdisc, it accesses the tcx_entry that was already freed in step 4, causing the UAF to occur: cleanup_net() => ops_exit_list() => default_device_exit_batch() => unregister_netdevice_many() => unregister_netdevice_many_notify() => dev_shutdown() => qdisc_put() => clsact_destroy() [c] => tcf_block_put_ext() => tcf_chain0_head_change_cb_del() => tcf_chain_head_change_item() => clsact_chain_head_change() => mini_qdisc_pair_swap() // UAF There are also other variants, the gist is to add an ingress (or clsact) qdisc with a specific shared block, then to replace that qdisc, waiting for the tcx_entry kfree_rcu() to be executed and subsequently accessing the current active qdisc's miniq one way or another. The correct fix is to turn the miniq_active boolean into a counter. What can be observed, at step 2 above, the counter transitions from 0->1, at step [a] from 1->2 (in order for the miniq object to remain active during the replacement), then in [b] from 2->1 and finally [c] 1->0 with the eventual release. The reference counter in general ranges from [0,2] and it does not need to be atomic since all access to the counter is protected by the rtnl mutex. With this in place, there is no longer a UAF happening and the tcx_entry is freed at the correct time.

AI Analysis

Technical Summary

CVE-2024-41010 is a use-after-free (UAF) vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, specifically related to the handling of traffic control (tc) extensions and qdisc (queueing discipline) management. The vulnerability arises from premature release of a tcx_entry object, which is a data structure used internally by the kernel to manage traffic control blocks associated with ingress or clsact qdiscs sharing a tc block. The flaw occurs when an old-style ingress or clsact qdisc is replaced by another instance, triggering a sequence where the tcx_entry is freed too early but still accessed later during network namespace cleanup. This leads to a use-after-free condition that can cause kernel memory corruption, potentially leading to system crashes or arbitrary code execution within the kernel context. The vulnerability is triggered through a specific sequence of operations: creating a network namespace, attaching ingress and clsact qdiscs with shared tc blocks, replacing qdiscs, and then closing the network namespace. The root cause is a mismanagement of the miniq_active boolean flag, which was incorrectly used to track the lifecycle of the tcx_entry. The fix involved converting this boolean into a reference counter to ensure the tcx_entry is only freed when no longer in use, preventing premature release and subsequent UAF. This vulnerability affects Linux kernel versions identified by the specified commit hashes and is relevant to systems using ingress or clsact qdiscs with shared tc blocks, which are common in advanced network traffic control and filtering scenarios.

Potential Impact

For European organizations, this vulnerability poses a significant risk primarily to servers and network infrastructure running Linux kernels with affected versions, especially those employing advanced traffic control features such as ingress or clsact qdiscs. Exploitation could allow attackers with local privileges or the ability to manipulate network namespaces to cause kernel crashes (denial of service) or potentially escalate privileges by executing arbitrary code in kernel space. This is particularly critical for data centers, cloud providers, telecom operators, and enterprises relying on Linux-based network appliances or virtualized environments. The impact extends to any system that uses network namespaces and complex traffic control configurations, which are common in containerized environments and NFV (Network Function Virtualization) deployments prevalent in Europe. Disruption or compromise of such systems could lead to service outages, data breaches, or lateral movement within networks. Although no known exploits are currently reported in the wild, the complexity of the vulnerability and its kernel-level nature warrant prompt attention to avoid future exploitation. The vulnerability also affects the integrity and availability of affected systems, with confidentiality potentially at risk if kernel-level code execution is achieved.

Mitigation Recommendations

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since the fix involves kernel code changes, applying official kernel updates from trusted sources or vendor-provided patches is essential. For environments using custom or long-term support kernels, backporting the patch or upgrading to a newer kernel version is recommended. Additionally, organizations should audit their use of ingress and clsact qdiscs with shared tc blocks, minimizing unnecessary complexity in traffic control configurations to reduce exposure. Network namespaces should be managed carefully, and any automated scripts or orchestration tools that manipulate qdiscs should be reviewed for potential triggering sequences. Employing kernel hardening techniques such as Kernel Page Table Isolation (KPTI), SELinux/AppArmor policies, and restricting unprivileged user access to network namespace creation can further reduce risk. Monitoring kernel logs for unusual qdisc or network namespace activity may help detect exploitation attempts. Finally, organizations should maintain an incident response plan that includes kernel-level vulnerabilities and ensure backups and recovery procedures are in place to mitigate potential denial-of-service impacts.