Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue exists in the component responsible for managing firewall rules (nf_tables), where a locking error occurs during certain cleanup operations. This can lead to a denial-of-service condition, impacting the availability of the affected system.
Technical details
A race condition exists in the Linux kernel netfilter subsystem (nf_tables) due to improper locking in the abort path. The commit mutex is prematurely released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end() when nf_tables_module_autoload() is called. This allows an asynchronous garbage collection (GC) worker to collect expired objects and acquire the released commit lock within the same GC sequence, leading to a kernel panic or inconsistent state. The fix involves moving the module autoloading logic to the end of the abort phase after the GC sequence has been finalized. This is a local attack requiring low privileges.
Affected products
- Linux Linux Kernel 4.19.316 to 4.20, 5.10.198 to 5.10.215, 5.15.134 to 5.15.155, 5.4.262 to 5.4.274, 6.1.56 to 6.1.86, 6.4.13 to 6.5, 6.5.1 to 6.6.26, 6.7 to 6.8.5
Timeline
- 2024-04-25: advisory: NVD publication date
- 2024-03-28: patched: Initial patch authored by Pablo Neira Ayuso
References
- https://git.kernel.org/stable/c/0d459e2ffb541841714839e8228b845458ed3b27
- https://git.kernel.org/stable/c/2cee2ff7f8cce12a63a0a23ffe27f08d99541494
- https://git.kernel.org/stable/c/61ac7284346c32f9a8c8ceac56102f7914060428
- https://git.kernel.org/stable/c/8038ee3c3e5b59bcd78467686db5270c68544e30
- https://git.kernel.org/stable/c/8d3a58af50e46167b6f1db47adadad03c0045dae
- https://git.kernel.org/stable/c/a34ba4bdeec0c3b629160497594908dc820110f1
- https://git.kernel.org/stable/c/eb769ff4e281f751adcaf4f4445cbf30817be139