CVE-2024-35910
Description
A flaw was found in the Linux kernel's TCP subsystem. When kernel-managed TCP sockets are closed, active network timers may continue executing after the associated network namespace has been dismantled and freed. A local attacker can exploit this timing condition to trigger a use-after-free memory error, leading to a system crash and Denial of Service (DoS).
Statement
A use-after-free flaw was found in the Linux kernel's TCP subsystem, rated by Red Hat as Moderate severity. When a kernel-managed TCP socket is closed, its network timers may continue running after the associated network namespace has been dismantled and freed. A local attacker able to trigger this timing condition could cause a use-after-free memory error, crashing the kernel and resulting in a denial of service. Red Hat Enterprise Linux 9 is not affected because the fix is already present in that release stream. In Red Hat Enterprise Linux 8, the kernel and kernel-rt packages in the 8.6, 8.8, and 8.10 update streams are affected, and fixes are being pursued through the responsible delegated update streams; the RHEL 6 and RHEL 7 Extended Lifecycle Support streams are out of support scope. Fedora and Hosted OpenShift (ARO) offerings that ship the affected kernel are also in scope. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.8) rather than the upstream CVE.org rating of Important (7.8) because exploitation requires winning a timing race with high attack complexity, and Red Hat's analysis found it unlikely that the issue could be triggered remotely.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.8 | 5.8 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | High | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | Low | High |
| Integrity Impact | Low | Low | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
