CVE-2024-42108
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the Linux kernel, a use-after-free was found in the rswitch network driver in rswitch_poll(). The bug is that the skb pointer is freed before its len field is used to update interface statistics. The fix moves the instructions to use skb->len before freeing.
Risk Assessment
Use-after-free can lead to system crashes or unexpected behavior, and in extreme cases to remote code execution if an attacker can send network packets.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2024-42108, which eliminates the use-after-free.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics. Let's move around the instructions to use skb->len before the skb is freed. This bug is trivial to reproduce using KFENCE. It will trigger a splat every few packets. A simple ARP request or ICMP echo request is enough.