Junglewise Threat Intelligence

CVE-2024-36286: Linux Kernel Netfilter race condition in nfnetlink_queue

CVE-2024-36286 · Severity: medium · CVSS 5.5 · Published 2024-06-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Netfilter component, which manages network traffic filtering and queueing. Under specific conditions, the system could experience a crash or instability when destroying network queue instances. This could allow a local user to cause a denial-of-service, potentially disrupting network operations or system availability.

Technical details

A vulnerability exists in the nfnetlink_queue component of the Linux kernel due to missing RCU (Read-Copy-Update) locking in the instance_destroy_rcu() function. Syzbot identified that nf_reinject() could be invoked without the necessary rcu_read_lock(), leading to suspicious RCU usage and potential use-after-free or null pointer dereference scenarios during the flushing of queue instances. An attacker with local access could trigger this condition to cause a kernel panic (Denial of Service). The fix involves explicitly acquiring and releasing the rcu_read_lock() during the nfqnl_flush() call within the destruction path.

Affected products

  • Linux Linux Kernel 2.6.25 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4

Timeline

  • 2024-05-15: patched: Initial fix authored by Eric Dumazet
  • 2024-06-21: advisory: CVE published in NVD

References

Related threats