CVE-2024-41040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-41040", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.621Z", "datePublished": "2024-07-29T14:31:53.853Z", "dateUpdated": "2026-08-05T11:34:54.957Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:54.957Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix UAF when resolving a clash\n\nKASAN reports the following UAF:\n\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\n\n Call Trace:\n <IRQ>\n dump_stack_lvl+0x48/0x70\n print_address_description.constprop.0+0x33/0x3d0\n print_report+0xc0/0x2b0\n kasan_report+0xd0/0x120\n __asan_load1+0x6c/0x80\n tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n tcf_ct_act+0x886/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n __irq_exit_rcu+0x82/0xc0\n irq_exit_rcu+0xe/0x20\n common_interrupt+0xa1/0xb0\n </IRQ>\n <TASK>\n asm_common_interrupt+0x27/0x40\n\n Allocated by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_alloc_info+0x1e/0x40\n __kasan_krealloc+0x133/0x190\n krealloc+0xaa/0x130\n nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n tcf_ct_act+0x1095/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\n Freed by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_free_info+0x2b/0x60\n ____kasan_slab_free+0x180/0x1f0\n __kasan_slab_free+0x12/0x30\n slab_free_freelist_hook+0xd2/0x1a0\n __kmem_cache_free+0x1a2/0x2f0\n kfree+0x78/0x120\n nf_conntrack_free+0x74/0x130 [nf_conntrack]\n nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n tcf_ct_act+0x12ad/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code executes in the NAPI receive softirq (`sch_handle_ingress` \u2192 `tcf_classify` \u2192 `tcf_ct_act`) on data taken directly from arriving packets, as the KASAN `<IRQ>`/`net_rx_action` trace shows. On any host configured with `action ct commit` (OVS-TC/OVN/Kubernetes offload nodes, the subsystem's primary deployment), an off-host attacker triggers it purely by sending routable UDP/ICMP/GRE traffic to or through the node.\nAC:L - The attacker controls both sides of the race by flooding packets with an identical 5-tuple, which RSS spreads across CPUs so two unconfirmed conntracks reach `nf_conntrack_confirm` concurrently \u2014 conntrack clashes on UDP bursts are so routine that the kernel has dedicated clash-resolution machinery and counters for them. Once a clash occurs the free of the loser ct and the subsequent stale dereference are deterministic.\nPR:N - Conntrack processing happens on ingress before any application-layer authentication or socket delivery, so the attacker needs no account, credentials, or local access on the target. The tc/act_ct configuration is established by the administrator as part of normal deployment, not by the attacker.\nUI:N - The UAF is triggered entirely by unsolicited inbound packets processed in softirq context; no local user or administrator has to open, mount, or interact with anything.\nS:U - The freed conntrack object, the corrupting writes, and the impacted flow-offload table all live within the same host kernel's security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `nf_ct_ext` is a plain kmalloc object that an attacker can reclaim and spray, and `nf_conn_act_ct_ext_find()` uses an attacker-controlled `u8` offset from it as a pointer offset, yielding a controlled out-of-bounds read whose result is written into the offload tuple. The dangling `nf_conn` is also read wholesale into the flow entry, exposing reclaimed kernel memory.\nI:H - `tcf_ct_flow_table_add()` writes into the freed object \u2014 `test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)`, `refcount_inc(&ct->ct_general.use)`, and `ct->proto.tcp.seen[].flags |=` \u2014 and persists `flow->ct` as a dangling pointer in the flow-offload table. With the `nf_conn` slab (SLAB_TYPESAFE_BY_RCU) reclaimed by attacker-sprayed connections, this produces refcount confusion and later double-free/UAF on a live object, a classic path to control-flow hijack.\nA:H - The use-after-free reliably crashes the kernel in softirq context under KASAN or slab poisoning, and unpoisoned it corrupts conntrack refcounting and the flow-offload table, leading to oops or panic. The attacker can repeat the packet flood indefinitely to keep re-triggering it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "f07c548314776231f0d47d73ec6caa5b17e876e8", "lessThan": "b81a523d54ea689414f67c9fb81a5b917a41ed55", "status": "affected", "versionType": "git"}, {"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "2b4d68df3f57ea746c430941ba9c03d7d8b5a23f", "status": "affected", "versionType": "git"}, {"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "4e71b10a100861fb27d9c5755dfd68f615629fae", "status": "affected", "versionType": "git"}, {"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "799a34901b634008db4a7ece3900e2b971d4c932", "status": "affected", "versionType": "git"}, {"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "ef472cc6693b16b202a916482df72f35d94bd69e", "status": "affected", "versionType": "git"}, {"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "26488172b0292bed837b95a006a3f3431d1898c3", "status": "affected", "versionType": "git"}, {"version": "30822781c89943b6a3ed122324ceb37cea7042a3", "status": "affected", "versionType": "git"}, {"version": "5.10.43", "lessThan": "5.10.222", "status": "affected", "versionType": "semver"}, {"version": "5.12.10", "lessThan": "5.13", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.43", "versionEndExcluding": "5.10.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.41"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.9.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55"}, {"url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"}, {"url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae"}, {"url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932"}, {"url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e"}, {"url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3"}], "title": "net/sched: Fix UAF when resolving a clash", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:38.071Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:23:16.958477Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:02.954Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:38.071Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:23:16.958477Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:20.356Z"}}], "cna": {"title": "net/sched: Fix UAF when resolving a clash", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code executes in the NAPI receive softirq (`sch_handle_ingress` \u2192 `tcf_classify` \u2192 `tcf_ct_act`) on data taken directly from arriving packets, as the KASAN `<IRQ>`/`net_rx_action` trace shows. On any host configured with `action ct commit` (OVS-TC/OVN/Kubernetes offload nodes, the subsystem's primary deployment), an off-host attacker triggers it purely by sending routable UDP/ICMP/GRE traffic to or through the node.\nAC:L - The attacker controls both sides of the race by flooding packets with an identical 5-tuple, which RSS spreads across CPUs so two unconfirmed conntracks reach `nf_conntrack_confirm` concurrently \u2014 conntrack clashes on UDP bursts are so routine that the kernel has dedicated clash-resolution machinery and counters for them. Once a clash occurs the free of the loser ct and the subsequent stale dereference are deterministic.\nPR:N - Conntrack processing happens on ingress before any application-layer authentication or socket delivery, so the attacker needs no account, credentials, or local access on the target. The tc/act_ct configuration is established by the administrator as part of normal deployment, not by the attacker.\nUI:N - The UAF is triggered entirely by unsolicited inbound packets processed in softirq context; no local user or administrator has to open, mount, or interact with anything.\nS:U - The freed conntrack object, the corrupting writes, and the impacted flow-offload table all live within the same host kernel's security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `nf_ct_ext` is a plain kmalloc object that an attacker can reclaim and spray, and `nf_conn_act_ct_ext_find()` uses an attacker-controlled `u8` offset from it as a pointer offset, yielding a controlled out-of-bounds read whose result is written into the offload tuple. The dangling `nf_conn` is also read wholesale into the flow entry, exposing reclaimed kernel memory.\nI:H - `tcf_ct_flow_table_add()` writes into the freed object \u2014 `test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)`, `refcount_inc(&ct->ct_general.use)`, and `ct->proto.tcp.seen[].flags |=` \u2014 and persists `flow->ct` as a dangling pointer in the flow-offload table. With the `nf_conn` slab (SLAB_TYPESAFE_BY_RCU) reclaimed by attacker-sprayed connections, this produces refcount confusion and later double-free/UAF on a live object, a classic path to control-flow hijack.\nA:H - The use-after-free reliably crashes the kernel in softirq context under KASAN or slab poisoning, and unpoisoned it corrupts conntrack refcounting and the flow-offload table, leading to oops or panic. The attacker can repeat the packet flood indefinitely to keep re-triggering it."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f07c548314776231f0d47d73ec6caa5b17e876e8", "lessThan": "b81a523d54ea689414f67c9fb81a5b917a41ed55", "versionType": "git"}, {"status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "2b4d68df3f57ea746c430941ba9c03d7d8b5a23f", "versionType": "git"}, {"status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "4e71b10a100861fb27d9c5755dfd68f615629fae", "versionType": "git"}, {"status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "799a34901b634008db4a7ece3900e2b971d4c932", "versionType": "git"}, {"status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "ef472cc6693b16b202a916482df72f35d94bd69e", "versionType": "git"}, {"status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "lessThan": "26488172b0292bed837b95a006a3f3431d1898c3", "versionType": "git"}, {"status": "affected", "version": "30822781c89943b6a3ed122324ceb37cea7042a3", "versionType": "git"}, {"status": "affected", "version": "5.10.43", "lessThan": "5.10.222", "versionType": "semver"}, {"status": "affected", "version": "5.12.10", "lessThan": "5.13", "versionType": "semver"}], "programFiles": ["net/sched/act_ct.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.222", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.100", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.41", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.10", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sched/act_ct.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55"}, {"url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"}, {"url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae"}, {"url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932"}, {"url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e"}, {"url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix UAF when resolving a clash\n\nKASAN reports the following UAF:\n\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\n\n Call Trace:\n <IRQ>\n dump_stack_lvl+0x48/0x70\n print_address_description.constprop.0+0x33/0x3d0\n print_report+0xc0/0x2b0\n kasan_report+0xd0/0x120\n __asan_load1+0x6c/0x80\n tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n tcf_ct_act+0x886/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n __irq_exit_rcu+0x82/0xc0\n irq_exit_rcu+0xe/0x20\n common_interrupt+0xa1/0xb0\n </IRQ>\n <TASK>\n asm_common_interrupt+0x27/0x40\n\n Allocated by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_alloc_info+0x1e/0x40\n __kasan_krealloc+0x133/0x190\n krealloc+0xaa/0x130\n nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n tcf_ct_act+0x1095/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\n Freed by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_free_info+0x2b/0x60\n ____kasan_slab_free+0x180/0x1f0\n __kasan_slab_free+0x12/0x30\n slab_free_freelist_hook+0xd2/0x1a0\n __kmem_cache_free+0x1a2/0x2f0\n kfree+0x78/0x120\n nf_conntrack_free+0x74/0x130 [nf_conntrack]\n nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n tcf_ct_act+0x12ad/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.10.43"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.100", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.41", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.10", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.12.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:54.957Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41040", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:34:54.957Z", "dateReserved": "2024-07-12T12:17:45.621Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-29T14:31:53.853Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b81a523d54ea689414f67c9fb81a5b917a41ed55", "status": "affected", "version": "f07c548314776231f0d47d73ec6caa5b17e876e8", "versionType": "git"}, {"lessThan": "2b4d68df3f57ea746c430941ba9c03d7d8b5a23f", "status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "versionType": "git"}, {"lessThan": "4e71b10a100861fb27d9c5755dfd68f615629fae", "status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "versionType": "git"}, {"lessThan": "799a34901b634008db4a7ece3900e2b971d4c932", "status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "versionType": "git"}, {"lessThan": "ef472cc6693b16b202a916482df72f35d94bd69e", "status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "versionType": "git"}, {"lessThan": "26488172b0292bed837b95a006a3f3431d1898c3", "status": "affected", "version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33", "versionType": "git"}, {"status": "affected", "version": "30822781c89943b6a3ed122324ceb37cea7042a3", "versionType": "git"}, {"lessThan": "5.10.222", "status": "affected", "version": "5.10.43", "versionType": "semver"}, {"lessThan": "5.13", "status": "affected", "version": "5.12.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.222", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.100", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.41", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2B53B37-EB61-42A6-B025-6E7F22431918", "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.10.43", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE9935B9-8F11-4DF6-83D0-CE5ADC82165C", "versionEndExcluding": "5.13", "versionStartIncluding": "5.12.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31C44972-374E-4ACF-9BAD-D5A04C707D45", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "100CDF74-4DB5-4FC6-A54B-BDBDB0C27137", "versionEndExcluding": "6.1.100", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96AC42B8-D66D-4AC5-B466-E9BA7910FA29", "versionEndExcluding": "6.6.41", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352", "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix UAF when resolving a clash\n\nKASAN reports the following UAF:\n\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\n\n Call Trace:\n <IRQ>\n dump_stack_lvl+0x48/0x70\n print_address_description.constprop.0+0x33/0x3d0\n print_report+0xc0/0x2b0\n kasan_report+0xd0/0x120\n __asan_load1+0x6c/0x80\n tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n tcf_ct_act+0x886/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n __irq_exit_rcu+0x82/0xc0\n irq_exit_rcu+0xe/0x20\n common_interrupt+0xa1/0xb0\n </IRQ>\n <TASK>\n asm_common_interrupt+0x27/0x40\n\n Allocated by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_alloc_info+0x1e/0x40\n __kasan_krealloc+0x133/0x190\n krealloc+0xaa/0x130\n nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n tcf_ct_act+0x1095/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\n Freed by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_free_info+0x2b/0x60\n ____kasan_slab_free+0x180/0x1f0\n __kasan_slab_free+0x12/0x30\n slab_free_freelist_hook+0xd2/0x1a0\n __kmem_cache_free+0x1a2/0x2f0\n kfree+0x78/0x120\n nf_conntrack_free+0x74/0x130 [nf_conntrack]\n nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n tcf_ct_act+0x12ad/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net/sched: Reparar UAF al resolver un conflicto KASAN reporta el siguiente UAF: ERROR: KASAN: slab-use-after-free en tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff888c07603600 por el controlador de tareas 130/6469 Seguimiento de llamadas: dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x 6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x 2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25 /0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30 c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1 /0xb0 asm_common_interrupt+0x27/0x40 Asignado por la tarea 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_alloc_info+0x1e/0x40 __kasan_krealloc+0x133/0x190 a/0x130 nf_ct_ext_add+0xed/0x230 [ nf_conntrack] tcf_ct_act+0x1095/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop. 0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/ 0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30 c/0x5c0 __do_softirq+0x14f/0x491 Liberado por la tarea 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/ 0x40 kasan_save_free_info+0x2b/0x60 ____kasan_slab_free+0x180/0x1f0 __kasan_slab_free+0x12/0x30 slab_free_freelist_hook+0xd2/0x1a0 __kmem_cache_free+0x1a2/0x2f0 kfree+0x78/0x120 conntrack_free+0x74/0x130 [nf_conntrack] nf_ct_destroy+0xb2/0x140 [nf_conntrack] __nf_ct_resolve_clash+0x529 /0x5d0 [nf_conntrack] nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack] __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack] tcf_ct_act+0x12ad/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c /0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_ done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 El ct se puede descartar si se resolvi\u00f3 un conflicto pero a\u00fan se pasa a la funci\u00f3n tcf_ct_flow_table_process_conn para su uso posterior. Este problema se puede solucionar recuperando ct de skb nuevamente despu\u00e9s de confirmar conntrack."}], "id": "CVE-2024-41040", "lastModified": "2026-08-04T11:19:21.393", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41040", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:23:16.958477Z", "version": "2.0.3"}}]}, "published": "2024-07-29T15:15:12.473", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7001", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:8107", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.75.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-10-15T00:00:00Z"}, {"advisory": "RHSA-2024:6567", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.35.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-11T00:00:00Z"}, {"advisory": "RHSA-2024:6567", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.35.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-11T00:00:00Z"}, {"advisory": "RHSA-2025:0063", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.99.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-01-08T00:00:00Z"}, {"advisory": "RHSA-2025:0064", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.99.1.rt14.384.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-01-08T00:00:00Z"}], "bugzilla": {"description": "kernel: net/sched: Fix UAF when resolving a clash", "id": "2300409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300409"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: Fix UAF when resolving a clash\nKASAN reports the following UAF:\nBUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\nRead of size 1 at addr ffff888c07603600 by task handler130/6469\nCall Trace:\n<IRQ>\ndump_stack_lvl+0x48/0x70\nprint_address_description.constprop.0+0x33/0x3d0\nprint_report+0xc0/0x2b0\nkasan_report+0xd0/0x120\n__asan_load1+0x6c/0x80\ntcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\ntcf_ct_act+0x886/0x1350 [act_ct]\ntcf_action_exec+0xf8/0x1f0\nfl_classify+0x355/0x360 [cls_flower]\n__tcf_classify+0x1fd/0x330\ntcf_classify+0x21c/0x3c0\nsch_handle_ingress.constprop.0+0x2c5/0x500\n__netif_receive_skb_core.constprop.0+0xb25/0x1510\n__netif_receive_skb_list_core+0x220/0x4c0\nnetif_receive_skb_list_internal+0x446/0x620\nnapi_complete_done+0x157/0x3d0\ngro_cell_poll+0xcf/0x100\n__napi_poll+0x65/0x310\nnet_rx_action+0x30c/0x5c0\n__do_softirq+0x14f/0x491\n__irq_exit_rcu+0x82/0xc0\nirq_exit_rcu+0xe/0x20\ncommon_interrupt+0xa1/0xb0\n</IRQ>\n<TASK>\nasm_common_interrupt+0x27/0x40\nAllocated by task 6469:\nkasan_save_stack+0x38/0x70\nkasan_set_track+0x25/0x40\nkasan_save_alloc_info+0x1e/0x40\n__kasan_krealloc+0x133/0x190\nkrealloc+0xaa/0x130\nnf_ct_ext_add+0xed/0x230 [nf_conntrack]\ntcf_ct_act+0x1095/0x1350 [act_ct]\ntcf_action_exec+0xf8/0x1f0\nfl_classify+0x355/0x360 [cls_flower]\n__tcf_classify+0x1fd/0x330\ntcf_classify+0x21c/0x3c0\nsch_handle_ingress.constprop.0+0x2c5/0x500\n__netif_receive_skb_core.constprop.0+0xb25/0x1510\n__netif_receive_skb_list_core+0x220/0x4c0\nnetif_receive_skb_list_internal+0x446/0x620\nnapi_complete_done+0x157/0x3d0\ngro_cell_poll+0xcf/0x100\n__napi_poll+0x65/0x310\nnet_rx_action+0x30c/0x5c0\n__do_softirq+0x14f/0x491\nFreed by task 6469:\nkasan_save_stack+0x38/0x70\nkasan_set_track+0x25/0x40\nkasan_save_free_info+0x2b/0x60\n____kasan_slab_free+0x180/0x1f0\n__kasan_slab_free+0x12/0x30\nslab_free_freelist_hook+0xd2/0x1a0\n__kmem_cache_free+0x1a2/0x2f0\nkfree+0x78/0x120\nnf_conntrack_free+0x74/0x130 [nf_conntrack]\nnf_ct_destroy+0xb2/0x140 [nf_conntrack]\n__nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\nnf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n__nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\ntcf_ct_act+0x12ad/0x1350 [act_ct]\ntcf_action_exec+0xf8/0x1f0\nfl_classify+0x355/0x360 [cls_flower]\n__tcf_classify+0x1fd/0x330\ntcf_classify+0x21c/0x3c0\nsch_handle_ingress.constprop.0+0x2c5/0x500\n__netif_receive_skb_core.constprop.0+0xb25/0x1510\n__netif_receive_skb_list_core+0x220/0x4c0\nnetif_receive_skb_list_internal+0x446/0x620\nnapi_complete_done+0x157/0x3d0\ngro_cell_poll+0xcf/0x100\n__napi_poll+0x65/0x310\nnet_rx_action+0x30c/0x5c0\n__do_softirq+0x14f/0x491\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack.", "A use-after-free vulnerability was found in the net/sshd tcf_ct_flow_table_process_conn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-41040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-41040\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41040\nhttps://lore.kernel.org/linux-cve-announce/2024072924-CVE-2024-41040-63d5@gregkh/T"], "statement": "Because exploitation of this flaw requires an attacker to have sufficient access to a system to generate significant amounts of spurious traffic, and because an attacker has very limited control over the consequences of the data corruption caused by this vulnerability, Red Hat assesses its impact as Moderate.\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-416: Use After Free vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nAccess to the platform is granted only after successful hard token-based multi-factor authentication (MFA) and is governed by least privilege to ensure that only authorized users and roles can execute or modify code. Red Hat also enforces least functionality, enabling only essential features, services, and ports. Hardening guidelines ensure the most restrictive settings required for operations, while baseline configurations enforce safe memory allocation and deallocation practices to reduce the risk of use-after-free vulnerabilities. The environment employs IPS/IDS and antimalware solutions to detect and prevent malicious code and provide real-time visibility into memory usage, lowering the risk of arbitrary code execution. Static code analysis and peer reviews enforce strong input validation and error handling, reducing the likelihood of denial-of-service (DoS) attacks. In the event of successful exploitation, process isolation prevents a compromised process from accessing memory freed by another, containing potential impact. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) enhance resilience against memory-related vulnerabilities.", "threat_severity": "Moderate"}

{}