In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.
During network namespace destruction, the fqdir_pre_exit() function frees all skb buffers from the fragment queue using inet_frag_queue_flush(), but does not set the INET_FRAG_COMPLETE flag and leaves pointers q->fragments_tail and q->last_run_head pointing to already freed memory. If the fragment handling thread managed to retrieve the queue via inet_frag_find() before the high_thresh threshold was lowered to zero, upon resuming work it will successfully pass the INET_FRAG_COMPLETE verification and dereference the freed fragments_tail. The inet_frag_queue_insert() function then reads FRAG_CB() metadata from the freed object, and on the attachment path writes to the ->next_frag field, causing a classic slab use-after-free. The same flush code is shared by IPv6, nf_conntrack_reasm6, and the 6lowpan reassembly mechanism, so all these subsystems are vulnerable.
An attacker can cause kernel memory corruption (heap use-after-free), which in practice opens the way to local privilege escalation or system destabilization (kernel panic). Due to the network nature of the vector (AV:N, PR:N, UI:N), it is also possible to trigger the vulnerability remotely by transmitting specially crafted IP packet fragments.
Apply patches available from the vendor according to references (commits: 010c3313a4d1, 0e823ca0e739, 32594b098549, 89b909e97045, c22599cc90e1 in the kernel.org stable repository). It is recommended to update the kernel to a version containing the above fixes or manually apply patches. As a temporary workaround, consider restricting the ability to create network namespaces by unprivileged users.
Linux kernel — versions indicated in vendor references (fix commits available in kernel.org stable repository). Affected subsystems: inet frags (IPv4), IPv6 fragment reassembly, nf_conntrack_reasm6, and 6lowpan reassembly.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux Kernel
OSLinux6.12.936.197.16.18.3 – 6.18.36 (excl.)6.19.1 – 7.0.13 (excl.)
Related vulnerabilities
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP
RCE przez YAML deserialization w IBM Aspera Faspex
RCE w VMware Workspace ONE Access i Identity Manager poprzez server-side template injection
Command Injection w VMware Workspace One Access i Identity Manager