CVE-2024-41010
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's BPF subsystem allows local attackers to potentially crash the system or execute arbitrary code. This affects Linux systems with specific network configurations using ingress or clsact qdiscs with shared tc blocks. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, leading to complete system compromise.
Likely Case
Kernel panic or system crash causing denial of service.
If Mitigated
No impact with proper patching or workarounds in place.
🎯 Exploit Status
Exploitation requires specific sequence of network operations and local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 1cb6f0bae50441f4b4b32a28315853b279c7404e, 230bb13650b0f186f540500fd5f5f7096a822a2a, f61ecf1bd5b562ebfd7d430ccb31619857e80857
Vendor Advisory: https://git.kernel.org/stable/c/1cb6f0bae50441f4b4b32a28315853b279c7404e
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version matches patched release.
🔧 Temporary Workarounds
Disable vulnerable network configurations
linuxAvoid using ingress or clsact qdiscs with shared tc blocks
# Remove ingress qdiscs: tc qdisc del dev <interface> ingress
# Remove clsact qdiscs: tc qdisc del dev <interface> clsact
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable configurations
- Monitor for unusual network configuration changes and kernel crashes
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if using ingress/clsact qdiscs: tc qdisc showCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits and test network functionality📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Use-after-free error messages in dmesg
- Network subsystem crashes
Network Indicators:
- Unexpected network configuration changes
- Network interface failures
SIEM Query:
kernel: *UAF* OR kernel: *use-after-free* OR kernel: *tcx_entry*🔗 References
- https://git.kernel.org/stable/c/1cb6f0bae50441f4b4b32a28315853b279c7404e
- https://git.kernel.org/stable/c/230bb13650b0f186f540500fd5f5f7096a822a2a
- https://git.kernel.org/stable/c/f61ecf1bd5b562ebfd7d430ccb31619857e80857
- https://git.kernel.org/stable/c/1cb6f0bae50441f4b4b32a28315853b279c7404e
- https://git.kernel.org/stable/c/230bb13650b0f186f540500fd5f5f7096a822a2a
- https://git.kernel.org/stable/c/f61ecf1bd5b562ebfd7d430ccb31619857e80857
