Executive brief
The Linux kernel's netfilter connection tracking subsystem contains a use-after-free vulnerability in helper hash handling. When netfilter conntrack initialization fails, the helper hash table is freed, but subsequent loading of netfilter modules (such as FTP conntrack) can attempt to access the freed memory, potentially causing system crashes or memory corruption. This affects systems where netfilter connection tracking is built into the kernel.
Technical details
This is a use-after-free (UAF) vulnerability in the netfilter conntrack helper registration code. The root cause occurs when nf_conntrack_init_start() fails (e.g., due to BPF registration failure) and calls nf_conntrack_helper_fini(), which frees the nf_ct_helper_hash pointer. However, when NF_CONNTRACK is built as a built-in (=y) rather than a module, subsequently loaded netfilter modules (e.g., netfilter_conntrack_ftp) can independently call nf_conntrack_helper_register(), which accesses the dangling nf_ct_helper_hash pointer without checking if it has been freed. The fix adds a null check in nf_conntrack_helper_register() and nullifies the pointer after freeing in nf_conntrack_helper_fini(). Attack vector is local (loading kernel modules). The patch was committed upstream and backported to stable kernel series.
Affected products
- Linux Linux kernel Multiple versions (patches backported to stable series linux-4.x through linux-7.x)
Timeline
- 2025-10-07: disclosed: CVE-2023-53619 disclosure date (per NVD)
- 2023-07-03: patched: Upstream fix committed by Florent Revest
- 2023-08-11: patched: Backported to stable kernel trees