Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue occurs within the Netfilter framework, which handles network traffic filtering and firewalling. By exploiting a race condition during the cleanup of temporary network sets, an attacker could trigger a kernel failure, leading to a denial-of-service condition.
Technical details
A race condition exists in the nf_tables component of the Linux kernel when handling anonymous sets with timeouts. While the rhashtable set garbage collection (GC) runs asynchronously, it can attempt to collect elements from anonymous sets that are simultaneously being released from the commit path. This occurs because the sets were not properly marked as 'dead' during the unbinding process. An attacker with local access can exploit this race to trigger a kernel panic or use-after-free scenario. The fix involves explicitly setting the 'dead' flag on anonymous sets during unbinding to ensure they are skipped by the async GC. This issue affects multiple stable kernel branches and has been patched in versions 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, and 6.7.12.
Affected products
- Linux Linux Kernel 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12
Timeline
- 2024-03-21: disclosed
- 2024-03-04: patched
References
- https://git.kernel.org/stable/c/291cca35818bd52a407bc37ab45a15816039e363
- https://git.kernel.org/stable/c/406b0241d0eb598a0b330ab20ae325537d8d8163
- https://git.kernel.org/stable/c/5224afbc30c3ca9ba23e752f0f138729b2c48dd8
- https://git.kernel.org/stable/c/552705a3650bbf46a22b1adedc1b04181490fc36
- https://git.kernel.org/stable/c/b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1
- https://git.kernel.org/stable/c/d75a589bb92af1abf3b779cfcd1977ca11b27033
- https://git.kernel.org/stable/c/e2d45f467096e931044f0ab7634499879d851a5c