Executive brief
A vulnerability exists in the Linux kernel's networking subsystem (Netfilter) that could allow a local user to crash the system or potentially gain elevated privileges. The issue occurs because the system incorrectly handles the timing of when certain firewall rules expire, leading to a memory error known as a 'use-after-free.' This affects the nftables component, which is commonly used to manage network traffic and security policies on Linux systems.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's nf_tables component (netfilter) due to a race condition in how set element timeouts are processed. Specifically, an element could expire while a control plane transaction is still unfinished because the system was not using a consistent timestamp across the transaction. This allows the garbage collection (GC) mechanism to remove elements that are still being referenced by active transactions. Attackers with local access can exploit this by manipulating nftables sets to trigger a UAF condition. The fix introduces a consistent transaction timestamp in the nftables per-namespace area to ensure elements do not expire prematurely during the control plane phase.
Affected products
- Linux Linux Kernel 4.1 to 4.19.320, 4.20 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.97, 6.2 to 6.6.84, 6.7 to 6.7.5, 6.8-rc1 to 6.8-rc3
Timeline
- 2024-02-16: patched: Fix committed to stable kernel branches
- 2024-05-14: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0d40e8cb1d1f56a994cdd2e015af622fdca9ed4d
- https://git.kernel.org/stable/c/383182db8d58c4237772ba0764cded4938a235c3
- https://git.kernel.org/stable/c/7395dfacfff65e9938ac0889dafa1ab01e987d15
- https://git.kernel.org/stable/c/7b17de2a71e56c10335b565cc7ad238e6d984379
- https://git.kernel.org/stable/c/7fa2e2960fff8322ce2ded57b5f8e9cbc450b967
- https://git.kernel.org/stable/c/b45176b869673417ace338b87cf9cdb66e2eeb01
- https://git.kernel.org/stable/c/eaf1a29ea5d7dba8e84e9e9f3b3f47d0cd540bfe