CVE-2024-35910

A flaw was found in the Linux kernel's TCP subsystem. When kernel-managed TCP sockets are closed, active network timers may continue executing after the associated network namespace has been dismantled and freed. A local attacker can exploit this timing condition to trigger a use-after-free memory error, leading to a system crash and Denial of Service (DoS).

A use-after-free flaw was found in the Linux kernel's TCP subsystem, rated by Red Hat as Moderate severity. When a kernel-managed TCP socket is closed, its network timers may continue running after the associated network namespace has been dismantled and freed. A local attacker able to trigger this timing condition could cause a use-after-free memory error, crashing the kernel and resulting in a denial of service. Red Hat Enterprise Linux 9 is not affected because the fix is already present in that release stream. In Red Hat Enterprise Linux 8, the kernel and kernel-rt packages in the 8.6, 8.8, and 8.10 update streams are affected, and fixes are being pursued through the responsible delegated update streams; the RHEL 6 and RHEL 7 Extended Lifecycle Support streams are out of support scope. Fedora and Hosted OpenShift (ARO) offerings that ship the affected kernel are also in scope. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.8) rather than the upstream CVE.org rating of Important (7.8) because exploitation requires winning a timing race with high attack complexity, and Red Hat's analysis found it unlikely that the issue could be triggered remotely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.