CVE-2024-46800 in Linux
Summary
by MITRE • 09/18/2024
In the Linux kernel, the following vulnerability has been resolved:
sch/netem: fix use after free in netem_dequeue
If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails")
Commands to trigger KASAN UaF:
ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/06/2026
The vulnerability identified as CVE-2024-46800 represents a critical use-after-free condition within the Linux kernel's networking subsystem, specifically affecting the netem qdisc implementation. This issue manifests in the sch/netem module where packet processing occurs through the netem_dequeue function, creating a scenario where memory corruption can occur due to improper handling of packet queuing operations. The flaw stems from a specific code path where packet enqueuing to an inner qdisc returns __NET_XMIT_STOLEN, yet the parent qdisc's backlog accounting remains unupdated, leading to inconsistent state management that can result in memory access violations.
The technical implementation of this vulnerability involves the interaction between multiple qdisc layers within the traffic control subsystem, where the netem qdisc operates as a delay and loss simulation tool. When a packet is processed through the netem_dequeue function and subsequently enqueued to an inner qdisc, the system fails to properly account for the packet's removal from the parent qdisc's queue length. This discrepancy creates a scenario where the packet memory may be freed while still being referenced, particularly when the inner qdisc returns __NET_XMIT_STOLEN, indicating that the packet was stolen or redirected rather than properly enqueued. The vulnerability is classified under CWE-416 as a use-after-free condition, where memory is accessed after it has been freed, potentially allowing for arbitrary code execution or system instability.
The operational impact of this vulnerability extends beyond simple system crashes, as it can be exploited to achieve privilege escalation or denial of service conditions within the kernel space. The specific trigger conditions involve creating a complex qdisc hierarchy with multiple nested layers, including drr qdiscs and netem qdiscs, combined with mirred actions that redirect packets through the system. The KASAN (Kernel Address Sanitizer) detection mechanism confirms the use-after-free by identifying memory access patterns that violate the expected memory lifecycle. This vulnerability affects systems running Linux kernel versions that include the problematic netem implementation, particularly those utilizing traffic control features with nested qdisc configurations. The attack surface is limited to systems actively using netem qdiscs in complex traffic control scenarios, but the potential for exploitation makes it a significant concern for network infrastructure and security-critical systems.
Mitigation strategies for CVE-2024-46800 require immediate kernel updates to versions that include the fix for the netem implementation, specifically addressing the qdisc_tree_reduce_backlog() call omission during packet drop scenarios. System administrators should prioritize patching affected systems, particularly those running kernel versions between 5.10 and 5.19 where this vulnerability was introduced. The fix involves ensuring that when packets are dropped due to __NET_XMIT_STOLEN return values, the parent qdisc's backlog accounting is properly maintained through appropriate qdisc_tree_reduce_backlog() calls. Additionally, organizations should review their traffic control configurations to minimize the use of complex nested qdisc hierarchies that could expose systems to similar vulnerabilities. Network monitoring should be enhanced to detect unusual packet processing patterns that might indicate exploitation attempts, and system hardening measures should be implemented to restrict access to traffic control interfaces where possible. This vulnerability aligns with ATT&CK technique T1059.006 for kernel-mode rootkits and T1490 for denial of service, emphasizing the need for comprehensive security measures across both network and system levels.