{"id":"DEBIAN-CVE-2024-44987","details":"In the Linux kernel, the following vulnerability has been resolved:  ipv6: prevent UAF in ip6_send_skb()  syzbot reported an UAF in ip6_send_skb() [1]  After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock().  A similar issue has been fixed in commit a688caa34beb (\"ipv6: take rcu lock in rawv6_send_hdrinc()\")  Another potential issue in ip6_finish_output2() is handled in a separate patch.  [1]  BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530  CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:  \u003cTASK\u003e   __dump_stack lib/dump_stack.c:93 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119   print_address_description mm/kasan/report.c:377 [inline]   print_report+0x169/0x550 mm/kasan/report.c:488   kasan_report+0x143/0x180 mm/kasan/report.c:601   ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964   rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588   rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926   sock_sendmsg_nosec net/socket.c:730 [inline]   __sock_sendmsg+0x1a6/0x270 net/socket.c:745   sock_write_iter+0x2dd/0x400 net/socket.c:1160  do_iter_readv_writev+0x60a/0x890   vfs_writev+0x37c/0xbb0 fs/read_write.c:971   do_writev+0x1b1/0x350 fs/read_write.c:1018   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8  \u003c/TASK\u003e  Allocated by task 6530:   kasan_save_stack mm/kasan/common.c:47 [inline]   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68   unpoison_slab_object mm/kasan/common.c:312 [inline]   __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338   kasan_slab_alloc include/linux/kasan.h:201 [inline]   slab_post_alloc_hook mm/slub.c:3988 [inline]   slab_alloc_node mm/slub.c:4037 [inline]   kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044   dst_alloc+0x12b/0x190 net/core/dst.c:89   ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670   make_blackhole net/xfrm/xfrm_policy.c:3120 [inline]   xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313   ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257   rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898   sock_sendmsg_nosec net/socket.c:730 [inline]   __sock_sendmsg+0x1a6/0x270 net/socket.c:745   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597   ___sys_sendmsg net/socket.c:2651 [inline]   __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 45:   kasan_save_stack mm/kasan/common.c:47 [inline]   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579   poison_slab_object+0xe0/0x150 mm/kasan/common.c:240   __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256   kasan_slab_free include/linux/kasan.h:184 [inline]   slab_free_hook mm/slub.c:2252 [inline]   slab_free mm/slub.c:4473 [inline]   kmem_cache_free+0x145/0x350 mm/slub.c:4548   dst_destroy+0x2ac/0x460 net/core/dst.c:124   rcu_do_batch kernel/rcu/tree.c:2569 [inline]   rcu_core+0xafd/0x1830 kernel/rcu/tree. ---truncated---","modified":"2026-09-15T09:03:10.931020820Z","published":"2024-09-04T20:15:07.890Z","upstream":["CVE-2024-44987"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-44987"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.112-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44987.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44987.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44987.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}