Executive brief
The Linux kernel's netfilter module contains a bug in its red-black tree set implementation that can cause a system crash when processing certain network filtering rules. When elements are added to firewall rule sets, the code can attempt to access invalid memory, triggering a general protection fault that disrupts network operations and availability.
Technical details
This vulnerability is a null pointer dereference and use-after-free condition in the nft_set_rbtree component (net/netfilter/nft_set_rbtree.c). The root cause lies in the nft_rbtree_gc_elem() function, where rb_prev() can return NULL without proper validation before dereferencing. Additionally, the __nft_rbtree_insert() function iterates over tree nodes without caching the next node pointer, allowing freed nodes to be accessed. The vulnerability is triggered when nf_tables_newsetelem adds elements to a rule set, causing a general protection fault. A local attacker with CAP_NET_ADMIN capability (or network access to a netfilter listener) can trigger the crash. Patches were released by the Linux kernel maintainers in May 2023 (commit 61ae320a and stable tree backports).
Affected products
- Linux Linux kernel 4.14 through 6.18 (specific affected versions vary by stable series)
Timeline
- 2023-05-11: disclosed: Fix proposed by Florian Westphal
- 2023-05-17: patched: Upstream fix committed (61ae320a29b0540c16931816299eb86bf2b66c08)
- 2023-05-30: patched: Backported to stable kernels via Sasha Levin