CVE-2024-44934 (GCVE-0-2024-44934)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:11 – Updated: 2025-11-03 22:13
VLAI?
Title
net: bridge: mcast: wait for previous gc cycles when removing port
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: wait for previous gc cycles when removing port syzbot hit a use-after-free[1] which is caused because the bridge doesn't make sure that all previous garbage has been collected when removing a port. What happens is: CPU 1 CPU 2 start gc cycle remove port acquire gc lock first wait for lock call br_multicasg_gc() directly acquire lock now but free port the port can be freed while grp timers still running Make sure all previous gc cycles have finished by using flush_work before freeing the port. [1] BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699 CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417 __run_timer_base kernel/time/timer.c:2428 [inline] __run_timer_base kernel/time/timer.c:2421 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2437
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e12cec65b5546f19217e26aafb8add6e2fadca18 , < 1e16828020c674b3be85f52685e8b80f9008f50f (git)
Affected: e12cec65b5546f19217e26aafb8add6e2fadca18 , < 0d8b26e10e680c01522d7cc14abe04c3265a928f (git)
Affected: e12cec65b5546f19217e26aafb8add6e2fadca18 , < e3145ca904fa8dbfd1a5bf0187905bc117b0efce (git)
Affected: e12cec65b5546f19217e26aafb8add6e2fadca18 , < b2f794b168cf560682ff976b255aa6d29d14a658 (git)
Affected: e12cec65b5546f19217e26aafb8add6e2fadca18 , < 92c4ee25208d0f35dafc3213cdf355fbe449e078 (git)
Create a notification for this product.
    Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.105 , ≤ 6.1.* (semver)
Unaffected: 6.6.46 , ≤ 6.6.* (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:27:51.533304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:55.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:13:38.280Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e16828020c674b3be85f52685e8b80f9008f50f",
              "status": "affected",
              "version": "e12cec65b5546f19217e26aafb8add6e2fadca18",
              "versionType": "git"
            },
            {
              "lessThan": "0d8b26e10e680c01522d7cc14abe04c3265a928f",
              "status": "affected",
              "version": "e12cec65b5546f19217e26aafb8add6e2fadca18",
              "versionType": "git"
            },
            {
              "lessThan": "e3145ca904fa8dbfd1a5bf0187905bc117b0efce",
              "status": "affected",
              "version": "e12cec65b5546f19217e26aafb8add6e2fadca18",
              "versionType": "git"
            },
            {
              "lessThan": "b2f794b168cf560682ff976b255aa6d29d14a658",
              "status": "affected",
              "version": "e12cec65b5546f19217e26aafb8add6e2fadca18",
              "versionType": "git"
            },
            {
              "lessThan": "92c4ee25208d0f35dafc3213cdf355fbe449e078",
              "status": "affected",
              "version": "e12cec65b5546f19217e26aafb8add6e2fadca18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.105",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: wait for previous gc cycles when removing port\n\nsyzbot hit a use-after-free[1] which is caused because the bridge doesn\u0027t\nmake sure that all previous garbage has been collected when removing a\nport. What happens is:\n      CPU 1                   CPU 2\n start gc cycle           remove port\n                         acquire gc lock first\n wait for lock\n                         call br_multicasg_gc() directly\n acquire lock now but    free port\n the port can be freed\n while grp timers still\n running\n\nMake sure all previous gc cycles have finished by using flush_work before\nfreeing the port.\n\n[1]\n  BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n  Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699\n\n  CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n  Call Trace:\n   \u003cIRQ\u003e\n   __dump_stack lib/dump_stack.c:88 [inline]\n   dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n   print_address_description mm/kasan/report.c:377 [inline]\n   print_report+0xc3/0x620 mm/kasan/report.c:488\n   kasan_report+0xd9/0x110 mm/kasan/report.c:601\n   br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n   call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792\n   expire_timers kernel/time/timer.c:1843 [inline]\n   __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417\n   __run_timer_base kernel/time/timer.c:2428 [inline]\n   __run_timer_base kernel/time/timer.c:2421 [inline]\n   run_timer_base+0x111/0x190 kernel/time/timer.c:2437"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:29:12.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e16828020c674b3be85f52685e8b80f9008f50f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d8b26e10e680c01522d7cc14abe04c3265a928f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3145ca904fa8dbfd1a5bf0187905bc117b0efce"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2f794b168cf560682ff976b255aa6d29d14a658"
        },
        {
          "url": "https://git.kernel.org/stable/c/92c4ee25208d0f35dafc3213cdf355fbe449e078"
        }
      ],
      "title": "net: bridge: mcast: wait for previous gc cycles when removing port",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44934",
    "datePublished": "2024-08-26T10:11:25.809Z",
    "dateReserved": "2024-08-21T05:34:56.664Z",
    "dateUpdated": "2025-11-03T22:13:38.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:13:38.280Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44934\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:27:51.533304Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.309Z\"}}], \"cna\": {\"title\": \"net: bridge: mcast: wait for previous gc cycles when removing port\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e12cec65b5546f19217e26aafb8add6e2fadca18\", \"lessThan\": \"1e16828020c674b3be85f52685e8b80f9008f50f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e12cec65b5546f19217e26aafb8add6e2fadca18\", \"lessThan\": \"0d8b26e10e680c01522d7cc14abe04c3265a928f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e12cec65b5546f19217e26aafb8add6e2fadca18\", \"lessThan\": \"e3145ca904fa8dbfd1a5bf0187905bc117b0efce\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e12cec65b5546f19217e26aafb8add6e2fadca18\", \"lessThan\": \"b2f794b168cf560682ff976b255aa6d29d14a658\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e12cec65b5546f19217e26aafb8add6e2fadca18\", \"lessThan\": \"92c4ee25208d0f35dafc3213cdf355fbe449e078\", \"versionType\": \"git\"}], \"programFiles\": [\"net/bridge/br_multicast.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.105\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bridge/br_multicast.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1e16828020c674b3be85f52685e8b80f9008f50f\"}, {\"url\": \"https://git.kernel.org/stable/c/0d8b26e10e680c01522d7cc14abe04c3265a928f\"}, {\"url\": \"https://git.kernel.org/stable/c/e3145ca904fa8dbfd1a5bf0187905bc117b0efce\"}, {\"url\": \"https://git.kernel.org/stable/c/b2f794b168cf560682ff976b255aa6d29d14a658\"}, {\"url\": \"https://git.kernel.org/stable/c/92c4ee25208d0f35dafc3213cdf355fbe449e078\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mcast: wait for previous gc cycles when removing port\\n\\nsyzbot hit a use-after-free[1] which is caused because the bridge doesn\u0027t\\nmake sure that all previous garbage has been collected when removing a\\nport. What happens is:\\n      CPU 1                   CPU 2\\n start gc cycle           remove port\\n                         acquire gc lock first\\n wait for lock\\n                         call br_multicasg_gc() directly\\n acquire lock now but    free port\\n the port can be freed\\n while grp timers still\\n running\\n\\nMake sure all previous gc cycles have finished by using flush_work before\\nfreeing the port.\\n\\n[1]\\n  BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\\n  Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699\\n\\n  CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0\\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\\n  Call Trace:\\n   \u003cIRQ\u003e\\n   __dump_stack lib/dump_stack.c:88 [inline]\\n   dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\\n   print_address_description mm/kasan/report.c:377 [inline]\\n   print_report+0xc3/0x620 mm/kasan/report.c:488\\n   kasan_report+0xd9/0x110 mm/kasan/report.c:601\\n   br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\\n   call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792\\n   expire_timers kernel/time/timer.c:1843 [inline]\\n   __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417\\n   __run_timer_base kernel/time/timer.c:2428 [inline]\\n   __run_timer_base kernel/time/timer.c:2421 [inline]\\n   run_timer_base+0x111/0x190 kernel/time/timer.c:2437\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.105\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:29:12.586Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44934\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:13:38.280Z\", \"dateReserved\": \"2024-08-21T05:34:56.664Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:11:25.809Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.