CVE-2024-46800

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sch/netem: fix use after free in netem_dequeue<br /> <br /> If netem_dequeue() enqueues packet to inner qdisc and that qdisc<br /> returns __NET_XMIT_STOLEN. The packet is dropped but<br /> qdisc_tree_reduce_backlog() is not called to update the parent&amp;#39;s<br /> q.qlen, leading to the similar use-after-free as Commit<br /> e04991a48dbaf382 ("netem: fix return value if duplicate enqueue<br /> fails")<br /> <br /> Commands to trigger KASAN UaF:<br /> <br /> ip link add type dummy<br /> ip link set lo up<br /> ip link set dummy0 up<br /> tc qdisc add dev lo parent root handle 1: drr<br /> tc filter add dev lo parent 1: basic classid 1:1<br /> tc class add dev lo classid 1:1 drr<br /> tc qdisc add dev lo parent 1:1 handle 2: netem<br /> tc qdisc add dev lo parent 2: handle 3: drr<br /> tc filter add dev lo parent 3: basic classid 3:1 action mirred egress<br /> redirect dev dummy0<br /> tc class add dev lo classid 3:1 drr<br /> ping -c1 -W0.01 localhost # Trigger bug<br /> tc class del dev lo classid 1:1<br /> tc class add dev lo classid 1:1 drr<br /> ping -c1 -W0.01 localhost # UaF