CVE-2024-45016

What it actually does

Use-after-free in Linux kernel netem_enqueue() caused by always returning NET_XMIT_SUCCESS on duplicate packet, leading to incorrect parent qdisc qlen and skipped qlen_notify() during destruction, leaving dangling pointers for classful qdiscs such as DRR.

Why it matters to the business

Linux systems performing network emulation may experience kernel instability or crashes under specific packet duplication and drop conditions, potentially disrupting network services and requiring urgent kernel patching across affected deployments.

How an attack unfolds

An attacker with local access triggers netem packet duplication, arranges for the duplicate or original to be dropped by root qdisc or routed differently, and relies on the erroneous NET_XMIT_SUCCESS return to cause parent qdisc destruction without proper cleanup, resulting in use-after-free.

How to fix it

Update the Linux kernel to a version containing commit 759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4 or later; rebuild and reboot with the patched kernel; test netem configurations post-upgrade.

How to confirm the fix worked

Verify kernel source or package contains the referenced commit; reproduce netem duplicate enqueue/drop sequences and confirm no qlen mismatch or use-after-free occurs; monitor for related oops messages.

Typical attack path

1. Obtain local access on a Linux system using netem qdisc
2. Configure netem with packet duplication enabled
3. Induce concurrent enqueue and drop scenarios involving root qdisc
4. Trigger parent qdisc destruction to dereference dangling pointer

How to detect it

Search kernel logs and crash dumps for netem, qdisc, DRR, and use-after-free oops traces; review system boot history around netem configuration changes.

What your security team should do

• Prioritize kernel updates on all systems using netem or classful qdiscs
• Audit network configurations for netem usage and disable duplication where unnecessary
• Monitor kernel logs for qdisc-related crashes during the remediation window