CVE-2024-46800

Q: What is the severity of CVE-2024-46800?

CVE-2024-46800 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's netem queuing discipline. When specific traffic control configurations are used, improper handling of stolen packets can lead to memory corruption, potentially allowing local privilege escalation or denial of service. Systems running affected Linux kernel versions with netem qdisc configurations are vulnerable.

7.8 HIGH

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's netem queuing discipline. When specific traffic control configurations are used, improper handling of stolen packets can lead to memory corruption, potentially allowing local privilege escalation or denial of service. Systems running affected Linux kernel versions with netem qdisc configurations are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but references indicate stable kernel patches. Likely affects multiple recent versions before fixes.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when netem queuing discipline is configured with specific traffic control rules as shown in the trigger commands.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

Kernel panic leading to denial of service or system instability when specific traffic control rules are applied.

🟢

If Mitigated

No impact if netem qdisc is not configured or if systems are patched.

🌐 Internet-Facing: LOW - Requires local access and specific configuration.

🏢 Internal Only: MEDIUM - Local attackers with user access could exploit this to escalate privileges or cause denial of service.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploit requires local access and specific traffic control configuration. The CVE includes trigger commands that demonstrate the bug.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 14f91ab8d391f249b845916820a56f42cf747241, 295ad5afd9efc5f67b86c64fce28fb94e26dc4c9, 32008ab989ddcff1a485fa2b4906234c25dc5cd6, 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a, 98c75d76187944296068d685dfd8a1e9fd8c4fdc

Vendor Advisory: https://git.kernel.org/stable/c/14f91ab8d391f249b845916820a56f42cf747241

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable netem qdisc configurations

linux

Remove or avoid using netem queuing discipline configurations that could trigger the vulnerability.

tc qdisc del dev lo root
tc qdisc del dev dummy0 root

🧯 If You Can't Patch

Restrict local user access to systems where netem configurations are used
Monitor for unusual traffic control configuration changes or kernel panic events

🔍 How to Verify

Check if Vulnerable:

Check if netem qdisc is configured with commands like 'tc qdisc show' and verify kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version after update matches patched version and test with trigger commands to ensure no crash occurs.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN use-after-free reports in dmesg
Unexpected system crashes

Network Indicators:

Unusual traffic control rule changes
Netem qdisc configurations matching trigger pattern

SIEM Query:

source="kernel" AND ("panic" OR "KASAN: use-after-free" OR "netem_dequeue")

📊 Metadata

CVE ID: CVE-2024-46800

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: September 18, 2024

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable netem qdisc configurations

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities