{"id":"DEBIAN-CVE-2024-50257","details":"In the Linux kernel, the following vulnerability has been resolved:  netfilter: Fix use-after-free in get_info()  ip6table_nat module unload has refcnt warning for UAF. call trace is:  WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Modules linked in: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Call Trace:  \u003cTASK\u003e  get_info+0x128/0x180  do_ip6t_get_ctl+0x6a/0x430  nf_getsockopt+0x46/0x80  ipv6_getsockopt+0xb9/0x100  rawv6_getsockopt+0x42/0x190  do_sock_getsockopt+0xaa/0x180  __sys_getsockopt+0x70/0xc0  __x64_sys_getsockopt+0x20/0x30  do_syscall_64+0xa2/0x1a0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows:  cpu0\t\t\t\t      cpu1 module_exit //mod-\u003estate = MODULE_STATE_GOING   ip6table_nat_exit     xt_unregister_template \tkfree(t) \t//removed from templ_list \t\t\t\t      getinfo() \t\t\t\t\t  t = xt_find_table_lock \t\t\t\t\t\tlist_for_each_entry(tmpl, &xt_templates[af]...) \t\t\t\t\t\t\tif (strcmp(tmpl-\u003ename, name)) \t\t\t\t\t\t\t\tcontinue;  //table not found \t\t\t\t\t\t\ttry_module_get \t\t\t\t\t\tlist_for_each_entry(t, &xt_net-\u003etables[af]...) \t\t\t\t\t\t\treturn t;  //not get refcnt \t\t\t\t\t  module_put(t-\u003eme) //uaf     unregister_pernet_subsys     //remove table from xt_net list  While xt_table module was going away and has been removed from xt_templates list, we couldnt get refcnt of xt_table-\u003eme. Check module in xt_net-\u003etables list re-traversal to fix it.","modified":"2026-09-15T09:03:15.577957506Z","published":"2024-11-09T11:15:11.340Z","upstream":["CVE-2024-50257"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-50257"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.119-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50257.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50257.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50257.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}