Executive brief
The Linux kernel's netfilter connection tracking module incorrectly calculates timeout values for unconfirmed network connections. This error can cause incorrect timeout intervals to be set or reported when managing network connections through the netfilter API, potentially leading to connections being prematurely closed or held open longer than intended, affecting network stability and availability.
Technical details
This vulnerability exists in the Linux kernel's netfilter conntrack subsystem, specifically in the handling of timeout values in the nf_conn structure. The root cause is that the code fails to distinguish between two states: before confirmation (when timeout is an interval in jiffies) and after confirmation (when timeout becomes a timestamp). Before confirmation, the code incorrectly adds the current time stamp (nfct_time_stamp) twice when setting timeout via ctnetlink_change_timeout(), and incorrectly subtracts it when getting timeout via ctnetlink_dump_timeout(). The vulnerability affects unconfirmed conntrack objects accessed through the netfilter netlink interface. The fix separates the handling into two cases: for unconfirmed connections, timeout is stored as a plain interval; for confirmed connections, it is stored as a timestamp. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions with netfilter conntrack support since introduction of nfnetlink_queue conntrack support (a4b4766c3ceb)
Timeline
- 2025-10-07: disclosed
- 2023-04-19: patched