{
  "threat_severity" : "Important",
  "public_date" : "2024-06-06T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: TIPC message reassembly use-after-free remote code execution vulnerability",
    "id" : "2277238",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2277238"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ntipc: fix UAF in error path\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n<IRQ>\n__dump_stack linux/lib/dump_stack.c:88\ndump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\nprint_address_description linux/mm/kasan/report.c:377\nprint_report+0xc4/0x620 linux/mm/kasan/report.c:488\nkasan_report+0xda/0x110 linux/mm/kasan/report.c:601\nkfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\nskb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\nskb_release_all linux/net/core/skbuff.c:1094\n__kfree_skb linux/net/core/skbuff.c:1108\nkfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\nkfree_skb linux/./include/linux/skbuff.h:1244\ntipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\ntipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\ntipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\ntipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\ntipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\nudp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\nudp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\nudp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n__udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\nip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\nip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\nNF_HOOK linux/./include/linux/netfilter.h:314\nNF_HOOK linux/./include/linux/netfilter.h:308\nip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\ndst_input linux/./include/net/dst.h:461\nip_rcv_finish linux/net/ipv4/ip_input.c:449\nNF_HOOK linux/./include/linux/netfilter.h:314\nNF_HOOK linux/./include/linux/netfilter.h:308\nip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n__netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n__netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\nprocess_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n__napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\nnapi_poll linux/net/core/dev.c:6645\nnet_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n__do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\ndo_softirq linux/kernel/softirq.c:454\ndo_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n</IRQ>\n<TASK>\n__local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\nlocal_bh_enable linux/./include/linux/bottom_half.h:33\nrcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n__dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\ndev_queue_xmit linux/./include/linux/netdevice.h:3169\nneigh_hh_output linux/./include/net/neighbour.h:526\nneigh_output linux/./include/net/neighbour.h:540\nip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n__ip_finish_output linux/net/ipv4/ip_output.c:313\n__ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\nip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\nNF_HOOK_COND linux/./include/linux/netfilter.h:303\nip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\ndst_output linux/./include/net/dst.h:451\nip_local_out linux/net/ipv4/ip_output.c:129\nip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\nudp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\nudp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\ninet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\nsock_sendmsg_nosec linux/net/socket.c:730\n__sock_sendmsg linux/net/socket.c:745\n__sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n__do_sys_sendto linux/net/socket.c:2203\n__se_sys_sendto linux/net/socket.c:2199\n__x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\ndo_syscall_x64 linux/arch/x86/entry/common.c:52\ndo_syscall_\n---truncated---", "A use-after-free (UAF) flaw exists in the Linux Kernel within the reassembly of fragmented TIPC messages, specifically in the tipc_buf_append() function. The issue results due to a lack of checks in the error handling cleanup and can trigger a UAF on \"struct sk_buff\", which may lead to remote code execution." ],
  "statement" : "While the TIPC module is not loaded by default, this flaw might be used as one in a series of attacks. For that reason, and because of the possibility of remote code execution on systems where this module has been loaded, Red Hat assesses the impact of this flaw as Important.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5102",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5101",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.16.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-20T00:00:00Z",
    "advisory" : "RHSA-2024:5522",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7002",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.4",
    "package" : "kernel-0:4.18.0-305.141.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7003",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.4::nfv",
    "package" : "kernel-rt-0:4.18.0-305.141.1.rt7.217.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7002",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.4",
    "package" : "kernel-0:4.18.0-305.141.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7002",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.4",
    "package" : "kernel-0:4.18.0-305.141.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
    "release_date" : "2024-10-01T00:00:00Z",
    "advisory" : "RHSA-2024:7427",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.4",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2024-07-10T00:00:00Z",
    "advisory" : "RHSA-2024:4447",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.6",
    "package" : "kernel-0:4.18.0-372.111.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2024-07-10T00:00:00Z",
    "advisory" : "RHSA-2024:4447",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.6",
    "package" : "kernel-0:4.18.0-372.111.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2024-07-10T00:00:00Z",
    "advisory" : "RHSA-2024:4447",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.6",
    "package" : "kernel-0:4.18.0-372.111.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2024-07-15T00:00:00Z",
    "advisory" : "RHSA-2024:4547",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.6",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-08-13T00:00:00Z",
    "advisory" : "RHSA-2024:5255",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.8",
    "package" : "kernel-0:4.18.0-477.67.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-08-19T00:00:00Z",
    "advisory" : "RHSA-2024:5520",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.8",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-07-17T00:00:00Z",
    "advisory" : "RHSA-2024:4583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.26.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-07-17T00:00:00Z",
    "advisory" : "RHSA-2024:4583",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.26.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-07-23T00:00:00Z",
    "advisory" : "RHSA-2024:4713",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-08-13T00:00:00Z",
    "advisory" : "RHSA-2024:5257",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "kernel-0:5.14.0-70.112.1.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-08-13T00:00:00Z",
    "advisory" : "RHSA-2024:5256",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0::nfv",
    "package" : "kernel-rt-0:5.14.0-70.112.1.rt21.184.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-08-26T00:00:00Z",
    "advisory" : "RHSA-2024:5858",
    "cpe" : "cpe:/o:redhat:rhel_e4s:9.0",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-15T00:00:00Z",
    "advisory" : "RHSA-2024:4533",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "kernel-0:5.14.0-284.73.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-15T00:00:00Z",
    "advisory" : "RHSA-2024:4554",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.73.1.rt14.358.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-15T00:00:00Z",
    "advisory" : "RHSA-2024:4548",
    "cpe" : "cpe:/o:redhat:rhel_eus:9.2",
    "package" : "kpatch-patch"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-36886\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36886\nhttps://lore.kernel.org/all/752f1ccf762223d109845365d07f55414058e5a3.1714484273.git.pabeni@redhat.com/\nhttps://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36886-dd83@gregkh/T/#u" ],
  "name" : "CVE-2024-36886",
  "mitigation" : {
    "value" : "The TIPC module is not automatically loaded in default configurations. When required, administrative privileges are required to explicitly load this module.\nTo determine if the TIPC module is loaded, use the following command:\n# grep tipc /proc/modules\nLook for output similar to the following:\ntipc 479232 0 - Live 0xffffffffc1ba5000\nip6_udp_tunnel 16384 1 tipc, Live 0xffffffffc1b9b000\nudp_tunnel 32768 1 tipc, Live 0xffffffffc1b8b000\nLoading the module can be prevented with the following instructions:\n# echo \"install tipc /bin/true\" >> /etc/modprobe.d/disable-tipc.conf\nThe system will need to be restarted if the module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use.\nIf the system requires this module to work correctly, this mitigation may not be suitable.",
    "lang" : "en:us"
  },
  "csaw" : false
}