CVE-2024-50130

What it actually does

Use-after-free in __nf_unregister_net_hook triggered when a BPF netfilter link releases its reference to a net namespace that has already been dismantled, due to missing netns hold in bpf_nf_link_attach.

Why it matters to the business

Kernel memory corruption or crashes on Linux systems using BPF programs attached to netfilter hooks, causing denial of service and potential service disruption; low exploitation probability but requires prompt patching on affected kernels.

How an attack unfolds

An attacker attaches a BPF program to a netfilter hook via bpf_nf_link_attach without taking a netns reference, then triggers link release through close or process exit after the net namespace has been freed, leading to the observed slab-use-after-free during hook unregistration.

How to fix it

Upgrade Linux kernel to commit f41bd93b3e0508edc7ba820357f949071dcc0acc or later stable versions containing the netns reference fix; apply distribution updates that include this patch.

How to confirm the fix worked

Verify kernel source contains the netns hold/release logic around bpf_nf_link_attach and bpf_nf_link_release; confirm no KASAN reports for __nf_unregister_net_hook after upgrade and test BPF netfilter attachment scenarios.

Typical attack path

1. Create and attach BPF netfilter link in a target netns
2. Trigger netns teardown or exit while deferring link cleanup
3. Release the BPF link after netns memory is freed
4. Trigger __nf_unregister_net_hook to access freed slab memory

How to detect it

Search kernel logs for KASAN slab-use-after-free reports citing __nf_unregister_net_hook, bpf_nf_link_release, or bpf_link_free; correlate with processes performing BPF netfilter link attach/release operations.

• __nf_unregister_net_hook+0x640/0x6b0
• bpf_nf_link_release+0xda/0x1e0
• BUG: KASAN: slab-use-after-free

What your security team should do

• Prioritize kernel upgrades on systems running BPF netfilter programs
• Monitor for kernel oops or KASAN splats involving netfilter BPF paths
• Restrict unprivileged BPF attachment where possible until patched