GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56635 (GCVE-0-2024-56635)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-08-05 11:45
VLAI
Title
net: avoid potential UAF in default_operstate()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: avoid potential UAF in default_operstate() syzbot reported an UAF in default_operstate() [1] Issue is a race between device and netns dismantles. After calling __rtnl_unlock() from netdev_run_todo(), we can not assume the netns of each device is still alive. Make sure the device is not in NETREG_UNREGISTERED state, and add an ASSERT_RTNL() before the call to __dev_get_by_index(). We might move this ASSERT_RTNL() in __dev_get_by_index() in the future. [1] BUG: KASAN: slab-use-after-free in __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 Read of size 8 at addr ffff888043eba1b0 by task syz.0.0/5339 CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 default_operstate net/core/link_watch.c:51 [inline] rfc2863_policy+0x224/0x300 net/core/link_watch.c:67 linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170 netdev_run_todo+0x461/0x1000 net/core/dev.c:10894 rtnl_unlock net/core/rtnetlink.c:152 [inline] rtnl_net_unlock include/linux/rtnetlink.h:133 [inline] rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520 rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2a3cb80809 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008 RBP: 00007f2a3cbf393e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8 </TASK> Allocated by task 5339: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kmalloc_array_noprof include/linux/slab.h:945 [inline] netdev_create_hash net/core/dev.c:11870 [inline] netdev_init+0x10c/0x250 net/core/dev.c:11890 ops_init+0x31e/0x590 net/core/net_namespace.c:138 setup_net+0x287/0x9e0 net/core/net_namespace.c:362 copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500 create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x57d/0xa70 kernel/fork.c:3314 __do_sys_unshare kernel/fork.c:3385 [inline] __se_sys_unshare kernel/fork.c:3383 [inline] __x64_sys_unshare+0x38/0x40 kernel/fork.c:3383 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x8 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:12 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8c55facecd7ade835287298ce325f930d888d8ec , < 3265aab0736f78bb218200b06b1abb525c316269 (git)
Affected: 8c55facecd7ade835287298ce325f930d888d8ec , < 316183d58319f191e16503bc2dffa156c4442df2 (git)
Affected: 8c55facecd7ade835287298ce325f930d888d8ec , < 750e51603395e755537da08f745864c93e3ce741 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:12:40.278798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:08.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/link_watch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3265aab0736f78bb218200b06b1abb525c316269",
              "status": "affected",
              "version": "8c55facecd7ade835287298ce325f930d888d8ec",
              "versionType": "git"
            },
            {
              "lessThan": "316183d58319f191e16503bc2dffa156c4442df2",
              "status": "affected",
              "version": "8c55facecd7ade835287298ce325f930d888d8ec",
              "versionType": "git"
            },
            {
              "lessThan": "750e51603395e755537da08f745864c93e3ce741",
              "status": "affected",
              "version": "8c55facecd7ade835287298ce325f930d888d8ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/link_watch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: avoid potential UAF in default_operstate()\n\nsyzbot reported an UAF in default_operstate() [1]\n\nIssue is a race between device and netns dismantles.\n\nAfter calling __rtnl_unlock() from netdev_run_todo(),\nwe can not assume the netns of each device is still alive.\n\nMake sure the device is not in NETREG_UNREGISTERED state,\nand add an ASSERT_RTNL() before the call to\n__dev_get_by_index().\n\nWe might move this ASSERT_RTNL() in __dev_get_by_index()\nin the future.\n\n[1]\n\nBUG: KASAN: slab-use-after-free in __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\nRead of size 8 at addr ffff888043eba1b0 by task syz.0.0/5339\n\nCPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:489\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\n  __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\n  default_operstate net/core/link_watch.c:51 [inline]\n  rfc2863_policy+0x224/0x300 net/core/link_watch.c:67\n  linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170\n  netdev_run_todo+0x461/0x1000 net/core/dev.c:10894\n  rtnl_unlock net/core/rtnetlink.c:152 [inline]\n  rtnl_net_unlock include/linux/rtnetlink.h:133 [inline]\n  rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520\n  rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541\n  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\n  netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347\n  netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:726\n  ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\n  ___sys_sendmsg net/socket.c:2637 [inline]\n  __sys_sendmsg+0x269/0x350 net/socket.c:2669\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f2a3cb80809\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809\nRDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008\nRBP: 00007f2a3cbf393e R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8\n \u003c/TASK\u003e\n\nAllocated by task 5339:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\n  __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\n  kmalloc_noprof include/linux/slab.h:901 [inline]\n  kmalloc_array_noprof include/linux/slab.h:945 [inline]\n  netdev_create_hash net/core/dev.c:11870 [inline]\n  netdev_init+0x10c/0x250 net/core/dev.c:11890\n  ops_init+0x31e/0x590 net/core/net_namespace.c:138\n  setup_net+0x287/0x9e0 net/core/net_namespace.c:362\n  copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500\n  create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110\n  unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228\n  ksys_unshare+0x57d/0xa70 kernel/fork.c:3314\n  __do_sys_unshare kernel/fork.c:3385 [inline]\n  __se_sys_unshare kernel/fork.c:3383 [inline]\n  __x64_sys_unshare+0x38/0x40 kernel/fork.c:3383\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x8\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local syscalls only \u2014 `unshare(CLONE_NEWUSER|CLONE_NEWNET)` to create the namespace and an `RTM_DELLINK` rtnetlink message via `sendmsg()` on an `AF_NETLINK` socket. No network peer data is involved.\nAC:L - The attacker controls both sides of the race: they create and populate the netns, choose when to drop its last reference (triggering `cleanup_net`), and choose when to send RTM_DELLINK, and can retry the race in a loop indefinitely at no cost. syzbot reproduced it, and veth/vlan/macvlan satisfy the `iflink != ifindex` precondition in default configurations.\nPR:L - An unprivileged local user gets CAP_NET_ADMIN inside a new network namespace via `unshare -Urn`, which is exactly the path in the syzbot allocation trace (`ksys_unshare` \u2192 `copy_net_ns`), and that is sufficient to create veth devices and issue RTM_DELLINK.\nUI:N - The attacker performs all steps itself \u2014 namespace creation, device creation, link deletion, and namespace teardown \u2014 with no action required from any other user.\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - This is a slab use-after-free read of a freed `kmalloc-2k` hash array whose contents the attacker can control via heap spray, turning the `hlist_for_each_entry()` walk into a controlled-pointer dereference; the resulting carrier bit is reflected into `dev-\u003eoperstate` and read back over netlink, yielding a kernel memory disclosure oracle.\nI:H - A use-after-free on a heavily reused general-purpose slab cache gives the attacker influence over the freed object contents and over which pointer the kernel follows and stores as `peer`, which is the standard basis for escalating to control-flow/state corruption.\nA:H - KASAN confirms a slab-use-after-free read, and walking the stale hash bucket dereferences reused or garbage pointers, causing a kernel oops or panic; the race can be retried repeatedly to force a crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:36.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3265aab0736f78bb218200b06b1abb525c316269"
        },
        {
          "url": "https://git.kernel.org/stable/c/316183d58319f191e16503bc2dffa156c4442df2"
        },
        {
          "url": "https://git.kernel.org/stable/c/750e51603395e755537da08f745864c93e3ce741"
        }
      ],
      "title": "net: avoid potential UAF in default_operstate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56635",
    "datePublished": "2024-12-27T15:02:38.213Z",
    "dateReserved": "2024-12-27T15:00:39.838Z",
    "dateUpdated": "2026-08-05T11:45:36.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56635",
      "date": "2026-09-16",
      "epss": "0.00194",
      "percentile": "0.09352"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: avoid potential UAF in default_operstate()\\n\\nsyzbot reported an UAF in default_operstate() [1]\\n\\nIssue is a race between device and netns dismantles.\\n\\nAfter calling __rtnl_unlock() from netdev_run_todo(),\\nwe can not assume the netns of each device is still alive.\\n\\nMake sure the device is not in NETREG_UNREGISTERED state,\\nand add an ASSERT_RTNL() before the call to\\n__dev_get_by_index().\\n\\nWe might move this ASSERT_RTNL() in __dev_get_by_index()\\nin the future.\\n\\n[1]\\n\\nBUG: KASAN: slab-use-after-free in __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\nRead of size 8 at addr ffff888043eba1b0 by task syz.0.0/5339\\n\\nCPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:94 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n  print_address_description mm/kasan/report.c:378 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:489\\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\\n  __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\n  default_operstate net/core/link_watch.c:51 [inline]\\n  rfc2863_policy+0x224/0x300 net/core/link_watch.c:67\\n  linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170\\n  netdev_run_todo+0x461/0x1000 net/core/dev.c:10894\\n  rtnl_unlock net/core/rtnetlink.c:152 [inline]\\n  rtnl_net_unlock include/linux/rtnetlink.h:133 [inline]\\n  rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520\\n  rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911\\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541\\n  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\\n  netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347\\n  netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891\\n  sock_sendmsg_nosec net/socket.c:711 [inline]\\n  __sock_sendmsg+0x221/0x270 net/socket.c:726\\n  ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\\n  ___sys_sendmsg net/socket.c:2637 [inline]\\n  __sys_sendmsg+0x269/0x350 net/socket.c:2669\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f2a3cb80809\\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\\nRAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809\\nRDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008\\nRBP: 00007f2a3cbf393e R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\\nR13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8\\n \u003c/TASK\u003e\\n\\nAllocated by task 5339:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\\n  __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\\n  kmalloc_noprof include/linux/slab.h:901 [inline]\\n  kmalloc_array_noprof include/linux/slab.h:945 [inline]\\n  netdev_create_hash net/core/dev.c:11870 [inline]\\n  netdev_init+0x10c/0x250 net/core/dev.c:11890\\n  ops_init+0x31e/0x590 net/core/net_namespace.c:138\\n  setup_net+0x287/0x9e0 net/core/net_namespace.c:362\\n  copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500\\n  create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110\\n  unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228\\n  ksys_unshare+0x57d/0xa70 kernel/fork.c:3314\\n  __do_sys_unshare kernel/fork.c:3385 [inline]\\n  __se_sys_unshare kernel/fork.c:3383 [inline]\\n  __x64_sys_unshare+0x38/0x40 kernel/fork.c:3383\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x8\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: evitar un UAF potencial en default_operstate() syzbot inform\\u00f3 un UAF en default_operstate() [1] El problema es una carrera entre el desmantelamiento de dispositivos y redes. Despu\\u00e9s de llamar a __rtnl_unlock() desde netdev_run_todo(), no podemos asumir que las redes de cada dispositivo a\\u00fan est\\u00e9n activas. Aseg\\u00farese de que el dispositivo no est\\u00e9 en estado NETREG_UNREGISTERED y agregue un ASSERT_RTNL() antes de la llamada a __dev_get_by_index(). Es posible que movamos este ASSERT_RTNL() a __dev_get_by_index() en el futuro. [1] ERROR: KASAN: slab-use-after-free en __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff888043eba1b0 por la tarea syz.0.0/5339 CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 No contaminado 6.12.0-syzkaller-10296-gaaf20f870da0 #0 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:94 [en l\\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 imprimir_direcci\\u00f3n_descripci\\u00f3n mm/kasan/report.c:378 [en l\\u00ednea] imprimir_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 estado_operaci\\u00f3n_predeterminado net/core/link_watch.c:51 [en l\\u00ednea] rfc2863_policy+0x224/0x300 net/core/link_watch.c:67 linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170 netdev_run_todo+0x461/0x1000 net/core/dev.c:10894 rtnl_unlock net/core/rtnetlink.c:152 [en l\\u00ednea] rtnl_net_unlock include/linux/rtnetlink.h:133 [en l\\u00ednea] rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520 rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [en l\\u00ednea] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [en l\\u00ednea] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [en l\\u00ednea] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [en l\\u00ednea] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2a3cb80809 C\\u00f3digo: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809 RDX: 000000000000000 RSI: 0000000020000000 RDI: 0000000000000008 RBP: 00007f2a3cbf393e R08: 000000000000000 R09: 0000000000000000 R10: 00000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8  Asignado por la tarea 5339: kasan_save_stack mm/kasan/common.c:47 [en l\\u00ednea] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [en l\\u00ednea] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc incluir/linux/kasan.h:260 [en l\\u00ednea] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof incluir/linux/slab.h:901 [en l\\u00ednea] kmalloc_array_noprof incluir/linux/slab.h:945 [en l\\u00ednea] netdev_create_hash net/core/dev.c:11870 [en l\\u00ednea] netdev_init+0x10c/0x250 net/core/dev.c:11890 ops_init+0x31e/0x590 net/core/net_namespace.c:138 setup_net+0x287/0x9e0 net/core/net_namespace.c:362 copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500 crear_nuevos_espacios_de_nombres+0x425/0x7b0 kernel/nsproxy.c:110 dejar_de_compartir_espacios_de_nombres_nsproxy+0x124/0x180 kernel/nsproxy.c:228 dejar_de_compartir_ksys+0x57d/0xa70 kernel/fork.c:3314 __do_sys_unshare kernel/fork.c:3385 [en l\\u00ednea] __se_sys_unshare kernel/fork.c:3383 [en l\\u00ednea] __x64_sys_unshare+0x38/0x40 ---truncado---\"}]",
      "id": "CVE-2024-56635",
      "lastModified": "2024-12-27T15:15:23.207",
      "published": "2024-12-27T15:15:23.207",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/316183d58319f191e16503bc2dffa156c4442df2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3265aab0736f78bb218200b06b1abb525c316269\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/750e51603395e755537da08f745864c93e3ce741\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T03:08:07.000Z",
      "cve": "CVE-2024-56635",
      "id": "msrc_CVE-2024-56635",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: avoid potential UAF in default_operstate()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56635.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:23.207\",\"lastModified\":\"2026-06-17T08:12:36.460\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: avoid potential UAF in default_operstate()\\n\\nsyzbot reported an UAF in default_operstate() [1]\\n\\nIssue is a race between device and netns dismantles.\\n\\nAfter calling __rtnl_unlock() from netdev_run_todo(),\\nwe can not assume the netns of each device is still alive.\\n\\nMake sure the device is not in NETREG_UNREGISTERED state,\\nand add an ASSERT_RTNL() before the call to\\n__dev_get_by_index().\\n\\nWe might move this ASSERT_RTNL() in __dev_get_by_index()\\nin the future.\\n\\n[1]\\n\\nBUG: KASAN: slab-use-after-free in __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\nRead of size 8 at addr ffff888043eba1b0 by task syz.0.0/5339\\n\\nCPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:94 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n  print_address_description mm/kasan/report.c:378 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:489\\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\\n  __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\n  default_operstate net/core/link_watch.c:51 [inline]\\n  rfc2863_policy+0x224/0x300 net/core/link_watch.c:67\\n  linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170\\n  netdev_run_todo+0x461/0x1000 net/core/dev.c:10894\\n  rtnl_unlock net/core/rtnetlink.c:152 [inline]\\n  rtnl_net_unlock include/linux/rtnetlink.h:133 [inline]\\n  rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520\\n  rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911\\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541\\n  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\\n  netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347\\n  netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891\\n  sock_sendmsg_nosec net/socket.c:711 [inline]\\n  __sock_sendmsg+0x221/0x270 net/socket.c:726\\n  ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\\n  ___sys_sendmsg net/socket.c:2637 [inline]\\n  __sys_sendmsg+0x269/0x350 net/socket.c:2669\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f2a3cb80809\\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\\nRAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809\\nRDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008\\nRBP: 00007f2a3cbf393e R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\\nR13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8\\n \u003c/TASK\u003e\\n\\nAllocated by task 5339:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\\n  __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\\n  kmalloc_noprof include/linux/slab.h:901 [inline]\\n  kmalloc_array_noprof include/linux/slab.h:945 [inline]\\n  netdev_create_hash net/core/dev.c:11870 [inline]\\n  netdev_init+0x10c/0x250 net/core/dev.c:11890\\n  ops_init+0x31e/0x590 net/core/net_namespace.c:138\\n  setup_net+0x287/0x9e0 net/core/net_namespace.c:362\\n  copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500\\n  create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110\\n  unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228\\n  ksys_unshare+0x57d/0xa70 kernel/fork.c:3314\\n  __do_sys_unshare kernel/fork.c:3385 [inline]\\n  __se_sys_unshare kernel/fork.c:3383 [inline]\\n  __x64_sys_unshare+0x38/0x40 kernel/fork.c:3383\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x8\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: evitar un UAF potencial en default_operstate() syzbot inform\u00f3 un UAF en default_operstate() [1] El problema es una carrera entre el desmantelamiento de dispositivos y redes. Despu\u00e9s de llamar a __rtnl_unlock() desde netdev_run_todo(), no podemos asumir que las redes de cada dispositivo a\u00fan est\u00e9n activas. Aseg\u00farese de que el dispositivo no est\u00e9 en estado NETREG_UNREGISTERED y agregue un ASSERT_RTNL() antes de la llamada a __dev_get_by_index(). Es posible que movamos este ASSERT_RTNL() a __dev_get_by_index() en el futuro. [1] ERROR: KASAN: slab-use-after-free en __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888043eba1b0 por la tarea syz.0.0/5339 CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 No contaminado 6.12.0-syzkaller-10296-gaaf20f870da0 #0 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:94 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 imprimir_direcci\u00f3n_descripci\u00f3n mm/kasan/report.c:378 [en l\u00ednea] imprimir_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __dev_get_by_index+0x5d/0x110 net/core/dev.c:852 estado_operaci\u00f3n_predeterminado net/core/link_watch.c:51 [en l\u00ednea] rfc2863_policy+0x224/0x300 net/core/link_watch.c:67 linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170 netdev_run_todo+0x461/0x1000 net/core/dev.c:10894 rtnl_unlock net/core/rtnetlink.c:152 [en l\u00ednea] rtnl_net_unlock include/linux/rtnetlink.h:133 [en l\u00ednea] rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520 rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [en l\u00ednea] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [en l\u00ednea] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [en l\u00ednea] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2a3cb80809 C\u00f3digo: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809 RDX: 000000000000000 RSI: 0000000020000000 RDI: 0000000000000008 RBP: 00007f2a3cbf393e R08: 000000000000000 R09: 0000000000000000 R10: 00000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8  Asignado por la tarea 5339: kasan_save_stack mm/kasan/common.c:47 [en l\u00ednea] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [en l\u00ednea] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc incluir/linux/kasan.h:260 [en l\u00ednea] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof incluir/linux/slab.h:901 [en l\u00ednea] kmalloc_array_noprof incluir/linux/slab.h:945 [en l\u00ednea] netdev_create_hash net/core/dev.c:11870 [en l\u00ednea] netdev_init+0x10c/0x250 net/core/dev.c:11890 ops_init+0x31e/0x590 net/core/net_namespace.c:138 setup_net+0x287/0x9e0 net/core/net_namespace.c:362 copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500 crear_nuevos_espacios_de_nombres+0x425/0x7b0 kernel/nsproxy.c:110 dejar_de_compartir_espacios_de_nombres_nsproxy+0x124/0x180 kernel/nsproxy.c:228 dejar_de_compartir_ksys+0x57d/0xa70 kernel/fork.c:3314 __do_sys_unshare kernel/fork.c:3385 [en l\u00ednea] __se_sys_unshare kernel/fork.c:3383 [en l\u00ednea] __x64_sys_unshare+0x38/0x40 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/link_watch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8c55facecd7ade835287298ce325f930d888d8ec\",\"lessThan\":\"3265aab0736f78bb218200b06b1abb525c316269\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c55facecd7ade835287298ce325f930d888d8ec\",\"lessThan\":\"316183d58319f191e16503bc2dffa156c4442df2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c55facecd7ade835287298ce325f930d888d8ec\",\"lessThan\":\"750e51603395e755537da08f745864c93e3ce741\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/link_watch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-10T17:12:40.278798Z\",\"id\":\"CVE-2024-56635\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/316183d58319f191e16503bc2dffa156c4442df2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3265aab0736f78bb218200b06b1abb525c316269\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/750e51603395e755537da08f745864c93e3ce741\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:51:12+00:00",
      "cve": "CVE-2024-56635",
      "id": "CVE-2024-56635",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: avoid potential UAF in default_operstate()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56635.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:56:00Z",
      "cve": "CVE-2024-56635",
      "id": "CVE-2024-56635",
      "initial_release_date": "2025-01-10T00:21:50Z",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "499",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56635",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56635.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-10T17:12:40.278798Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-10T17:12:41.609Z\"}}], \"cna\": {\"title\": \"net: avoid potential UAF in default_operstate()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through local syscalls only \\u2014 `unshare(CLONE_NEWUSER|CLONE_NEWNET)` to create the namespace and an `RTM_DELLINK` rtnetlink message via `sendmsg()` on an `AF_NETLINK` socket. No network peer data is involved.\\nAC:L - The attacker controls both sides of the race: they create and populate the netns, choose when to drop its last reference (triggering `cleanup_net`), and choose when to send RTM_DELLINK, and can retry the race in a loop indefinitely at no cost. syzbot reproduced it, and veth/vlan/macvlan satisfy the `iflink != ifindex` precondition in default configurations.\\nPR:L - An unprivileged local user gets CAP_NET_ADMIN inside a new network namespace via `unshare -Urn`, which is exactly the path in the syzbot allocation trace (`ksys_unshare` \\u2192 `copy_net_ns`), and that is sufficient to create veth devices and issue RTM_DELLINK.\\nUI:N - The attacker performs all steps itself \\u2014 namespace creation, device creation, link deletion, and namespace teardown \\u2014 with no action required from any other user.\\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\\nC:H - This is a slab use-after-free read of a freed `kmalloc-2k` hash array whose contents the attacker can control via heap spray, turning the `hlist_for_each_entry()` walk into a controlled-pointer dereference; the resulting carrier bit is reflected into `dev-\u003eoperstate` and read back over netlink, yielding a kernel memory disclosure oracle.\\nI:H - A use-after-free on a heavily reused general-purpose slab cache gives the attacker influence over the freed object contents and over which pointer the kernel follows and stores as `peer`, which is the standard basis for escalating to control-flow/state corruption.\\nA:H - KASAN confirms a slab-use-after-free read, and walking the stale hash bucket dereferences reused or garbage pointers, causing a kernel oops or panic; the race can be retried repeatedly to force a crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8c55facecd7ade835287298ce325f930d888d8ec\", \"lessThan\": \"3265aab0736f78bb218200b06b1abb525c316269\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8c55facecd7ade835287298ce325f930d888d8ec\", \"lessThan\": \"316183d58319f191e16503bc2dffa156c4442df2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8c55facecd7ade835287298ce325f930d888d8ec\", \"lessThan\": \"750e51603395e755537da08f745864c93e3ce741\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/link_watch.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/link_watch.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3265aab0736f78bb218200b06b1abb525c316269\"}, {\"url\": \"https://git.kernel.org/stable/c/316183d58319f191e16503bc2dffa156c4442df2\"}, {\"url\": \"https://git.kernel.org/stable/c/750e51603395e755537da08f745864c93e3ce741\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: avoid potential UAF in default_operstate()\\n\\nsyzbot reported an UAF in default_operstate() [1]\\n\\nIssue is a race between device and netns dismantles.\\n\\nAfter calling __rtnl_unlock() from netdev_run_todo(),\\nwe can not assume the netns of each device is still alive.\\n\\nMake sure the device is not in NETREG_UNREGISTERED state,\\nand add an ASSERT_RTNL() before the call to\\n__dev_get_by_index().\\n\\nWe might move this ASSERT_RTNL() in __dev_get_by_index()\\nin the future.\\n\\n[1]\\n\\nBUG: KASAN: slab-use-after-free in __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\nRead of size 8 at addr ffff888043eba1b0 by task syz.0.0/5339\\n\\nCPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:94 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n  print_address_description mm/kasan/report.c:378 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:489\\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\\n  __dev_get_by_index+0x5d/0x110 net/core/dev.c:852\\n  default_operstate net/core/link_watch.c:51 [inline]\\n  rfc2863_policy+0x224/0x300 net/core/link_watch.c:67\\n  linkwatch_do_dev+0x3e/0x170 net/core/link_watch.c:170\\n  netdev_run_todo+0x461/0x1000 net/core/dev.c:10894\\n  rtnl_unlock net/core/rtnetlink.c:152 [inline]\\n  rtnl_net_unlock include/linux/rtnetlink.h:133 [inline]\\n  rtnl_dellink+0x760/0x8d0 net/core/rtnetlink.c:3520\\n  rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911\\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2541\\n  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\\n  netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347\\n  netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891\\n  sock_sendmsg_nosec net/socket.c:711 [inline]\\n  __sock_sendmsg+0x221/0x270 net/socket.c:726\\n  ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\\n  ___sys_sendmsg net/socket.c:2637 [inline]\\n  __sys_sendmsg+0x269/0x350 net/socket.c:2669\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f2a3cb80809\\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007f2a3d9cd058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\\nRAX: ffffffffffffffda RBX: 00007f2a3cd45fa0 RCX: 00007f2a3cb80809\\nRDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008\\nRBP: 00007f2a3cbf393e R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\\nR13: 0000000000000000 R14: 00007f2a3cd45fa0 R15: 00007ffd03bc65c8\\n \u003c/TASK\u003e\\n\\nAllocated by task 5339:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\\n  __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\\n  kmalloc_noprof include/linux/slab.h:901 [inline]\\n  kmalloc_array_noprof include/linux/slab.h:945 [inline]\\n  netdev_create_hash net/core/dev.c:11870 [inline]\\n  netdev_init+0x10c/0x250 net/core/dev.c:11890\\n  ops_init+0x31e/0x590 net/core/net_namespace.c:138\\n  setup_net+0x287/0x9e0 net/core/net_namespace.c:362\\n  copy_net_ns+0x33f/0x570 net/core/net_namespace.c:500\\n  create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110\\n  unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228\\n  ksys_unshare+0x57d/0xa70 kernel/fork.c:3314\\n  __do_sys_unshare kernel/fork.c:3385 [inline]\\n  __se_sys_unshare kernel/fork.c:3383 [inline]\\n  __x64_sys_unshare+0x38/0x40 kernel/fork.c:3383\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xf3/0x230 arch/x8\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:36.867Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:36.867Z\", \"dateReserved\": \"2024-12-27T15:00:39.838Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:38.213Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.