Executive brief
A vulnerability was identified in the Linux kernel's netfilter component, which manages network traffic filtering and firewall rules. A race condition during the removal of network modules could allow a local user to trigger a system crash or potentially access restricted memory. This issue primarily impacts system stability and availability.
Technical details
A race condition exists in the nf_tables component of the Linux kernel between the exit_net cleanup path and the asynchronous destroy workqueue. When the nf_tables module is removed, the exit_net path may release sets or elements while the destroy workqueue is still attempting to process them, resulting in a slab-use-after-free. An attacker with local access could exploit this to cause a kernel panic (DoS) or potentially read sensitive kernel memory. The fix involves ensuring pending destroy work is flushed before the network namespace resources are released. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.5 to 6.9-rc2
Timeline
- 2024-04-02: patched: Initial patch by Pablo Neira Ayuso
- 2024-05-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/24cea9677025e0de419989ecb692acd4bb34cac2
- https://git.kernel.org/stable/c/333b5085522cf1898d5a0d92616046b414f631a7
- https://git.kernel.org/stable/c/46c4481938e2ca62343b16ea83ab28f4c1733d31
- https://git.kernel.org/stable/c/4e8447a9a3d367b5065a0b7abe101da6e0037b6e
- https://git.kernel.org/stable/c/d2c9eb19fc3b11caebafde4c30a76a49203d18a6
- https://git.kernel.org/stable/c/f4e14695fe805eb0f0cb36e0ad6a560b9f985e86
- https://git.kernel.org/stable/c/f7e3c88cc2a977c2b9a8aa52c1ce689e7b394e49