Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue occurs when specific firewall configuration commands are combined, leading to an inconsistent internal state where network hooks remain active after their associated components are deleted. This primarily impacts system availability.
Technical details
A vulnerability exists in the nf_tables component of the Linux kernel netfilter subsystem. The issue arises because hook unregistration and hook updates (triggered by the table dormant flag) are both deferred to the commit phase. When a table flag update and a basechain deletion are combined in a single transaction, the kernel may delete a basechain while leaving its associated hook registered in the core. This inconsistency can lead to a kernel panic or other undefined behavior. The fix involves discarding table flag updates if there is a pending basechain deletion in the same transaction. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.4.262 to 5.4.274, 5.10.202 to 5.10.215, 5.13.1 to 5.15.155, 5.16 to 6.1.86, 6.2 to 6.6.26, 6.7 to 6.8.5
Timeline
- 2024-04-03: patched: Initial patch authored by Pablo Neira Ayuso
- 2024-05-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518
- https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4
- https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb
- https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927
- https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827
- https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78
- https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362