CVE-2024-46800

What it actually does

Use-after-free in netem_dequeue when an inner qdisc returns __NET_XMIT_STOLEN after enqueue, causing qdisc_tree_reduce_backlog to be skipped and leaving stale q.qlen references that can be dereferenced later.

Why it matters to the business

Local attackers with network configuration privileges can crash systems or escalate privileges on Linux hosts running affected kernels, leading to service outages and potential full host compromise in multi-tenant or container environments.

How an attack unfolds

An attacker with sufficient privileges configures a nested qdisc hierarchy involving netem and drr, then triggers packet processing paths that cause the stolen return value; subsequent class deletion and re-addition operations dereference freed memory, enabling memory corruption that can be turned into privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit f0bddb4de043399f16d1969dad5ee5b984a64e7b or later stable releases; apply vendor backports for all supported kernel series; rebuild and redeploy any custom kernels or container base images using the fixed tree.

How to confirm the fix worked

Verify the running kernel git commit or package version contains f0bddb4de043399f16d1969dad5ee5b984a64e7b; attempt reproduction of the provided tc hierarchy and ping triggers under KASAN or kernel memory debugging to confirm absence of UaF; monitor qdisc qlen counters for consistency after enqueue operations.

Typical attack path

1. Obtain local access or container escape sufficient for tc and ip commands
2. Create dummy interface and configure nested drr/netem qdisc tree with mirred redirect
3. Send crafted traffic (e.g., ping) to exercise netem_dequeue path returning __NET_XMIT_STOLEN
4. Delete and re-add child classes to trigger use-after-free during backlog accounting
5. Leverage resulting memory corruption for kernel code execution or privilege escalation

How to detect it

Review kernel logs for KASAN reports mentioning netem_dequeue or qdisc_tree_reduce_backlog; inspect audit logs for sequences of tc class add/del operations followed by network traffic on interfaces using netem; correlate with process execution of ip and tc commands by unprivileged users.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux systems within patch windows
• Restrict unprivileged use of tc and netem qdisc configuration via SELinux, AppArmor, or seccomp policies
• Audit systems for nested qdisc setups involving netem and drr that match the vulnerable pattern
• Include the fixed commit hash in automated kernel build and CI pipelines