Executive brief
The Linux kernel's netfilter firewall subsystem contains a use-after-free vulnerability in how it cleans up network device hooks when namespaces are destroyed. When virtual Ethernet (veth) devices are removed in certain namespace configurations, the kernel may attempt to access memory that has already been freed, potentially leading to system crashes or other unpredictable behavior that could allow local attackers to cause denial of service.
Technical details
This is a use-after-free vulnerability (CWE-416) in net/netfilter/nft_chain_filter.c within the netdev event handling for nf_tables. The root cause is a race condition in namespace cleanup: when a veth device is removed, it queues the peer namespace for removal; if both namespaces are exiting, device memory may be freed before the netns pre_exit hook attempts to unregister netdev hooks. The vulnerable code was checking `!check_net(ctx.net)` to skip UNREGISTER events during namespace shutdown, but this check incorrectly skipped hook cleanup when device memory was still needed. The fix removes this check and always processes UNREGISTER events in the notifier handler, ensuring hook->ops.dev remains accessible. This affects the netfilter firewall's ability to safely manage network hooks across namespace boundaries.
Affected products
- Linux Linux kernel Affected versions include multiple stable series; patch (commit dc1c9fd4a8bbe1e06add9053010b652449bfe411) was backported to stable kernels
Timeline
- 2023-05-04: disclosed: Commit authored by Florian Westphal
- 2023-05-24: patched: Backported to stable kernels
- 2025-12-30: advisory: CVE-2023-54200 published in NVD