{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53044", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.972Z", "datePublished": "2024-11-19T17:19:32.095Z", "dateUpdated": "2026-08-05T11:43:19.770Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:19.770Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()\n\nThis command:\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: block dev insert failed: -EBUSY.\n\nfails because user space requests the same block index to be set for\nboth ingress and egress.\n\n[ side note, I don't think it even failed prior to commit 913b47d3424e\n (\"net/sched: Introduce tc block netdev tracking infra\"), because this\n is a command from an old set of notes of mine which used to work, but\n alas, I did not scientifically bisect this ]\n\nThe problem is not that it fails, but rather, that the second time\naround, it fails differently (and irrecoverably):\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: dsa_core: Flow block cb is busy.\n\n[ another note: the extack is added by me for illustration purposes.\n the context of the problem is that clsact_init() obtains the same\n &q->ingress_block pointer as &q->egress_block, and since we call\n tcf_block_get_ext() on both of them, \"dev\" will be added to the\n block->ports xarray twice, thus failing the operation: once through\n the ingress block pointer, and once again through the egress block\n pointer. the problem itself is that when xa_insert() fails, we have\n emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the\n offload never sees a corresponding FLOW_BLOCK_UNBIND. ]\n\nEven correcting the bad user input, we still cannot recover:\n\n$ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact\nError: dsa_core: Flow block cb is busy.\n\nBasically the only way to recover is to reboot the system, or unbind and\nrebind the net device driver.\n\nTo fix the bug, we need to fill the correct error teardown path which\nwas missed during code movement, and call tcf_block_offload_unbind()\nwhen xa_insert() fails.\n\n[ last note, fundamentally I blame the label naming convention in\n tcf_block_get_ext() for the bug. The labels should be named after what\n they do, not after the error path that jumps to them. This way, it is\n obviously wrong that two labels pointing to the same code mean\n something is wrong, and checking the code correctness at the goto site\n is also easier ]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the rtnetlink `RTM_NEWQDISC` interface (`tc qdisc add/replace ... clsact ingress_block N egress_block N`), which requires a local netlink socket. Per kernel scoring guidance, tc/netlink qdisc paths are Local.\nAC:L - The trigger is a single deterministic command reproduced verbatim in the fix commit — no race, no memory-layout dependency, and the attacker fully controls both block indices that make `xa_insert()` fail. Every attempt reliably leaks the offload binding.\nPR:L - `rtnetlink_rcv_msg()` checks `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is namespace-relative, so an unprivileged user obtains it with `unshare -Urn` and can create a veth/dummy device (or use `lo`) to reach `tcf_block_get_ext()`. No real root in the init namespace is needed.\nUI:N - Exploitation is a self-contained sequence of netlink qdisc operations issued by the attacker. No victim action of any kind is involved.\nS:U - The corrupted state (`tcf_block`, `flow_block_cb`, `flow_indir_dev_info`) and the resulting impact are all within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missed `tcf_block_offload_unbind()` leaves callbacks and global-list entries pointing at a `tcf_block` that is then freed by `tcf_block_destroy()`; `tc_block_indr_cleanup()` and `existing_qdiscs_register()` later dereference those stale pointers, and a use-after-free lets the attacker read back attacker-groomed/adjacent kernel heap contents.\nI:H - The stale `flow_block_cb` remains linked into the freed block's `cb_list`, so the later `list_move()`/`list_splice()` and `block->lockeddevcnt--` write kernel pointers into freed, reallocatable slab memory — a classic list-corruption write primitive suitable for control-flow hijack. It also permanently corrupts driver offload state (`nooffloaddevcnt`, driver cb lists).\nA:H - The use-after-free on the freed `tcf_block` causes oopses/panics, and even without memory corruption the leaked bind permanently wedges tc hardware offload on the device — the commit notes recovery requires a reboot or driver rebind, and an unprivileged user can trigger it repeatedly to also leak memory." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/cls_api.c" ], "versions": [ { "version": "94e2557d086ad831027c54bc9c2130d337c72814", "lessThan": "8966eb69a143b1c032365fe84f2815f3c46f2590", "status": "affected", "versionType": "git" }, { "version": "94e2557d086ad831027c54bc9c2130d337c72814", "lessThan": "a13e690191eafc154b3f60afe9ce35aa9b9128b4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/cls_api.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.7", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8966eb69a143b1c032365fe84f2815f3c46f2590" }, { "url": "https://git.kernel.org/stable/c/a13e690191eafc154b3f60afe9ce35aa9b9128b4" } ], "title": "net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53044", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:13:37.820263Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:19.316Z" } } ] } }