Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the 'ipset' component used for managing IP address sets in firewalls. Under certain conditions when sets are being destroyed, the system may experience stability issues or crashes. This primarily impacts the availability of the system but does not directly expose sensitive data.
Technical details
A vulnerability exists in the Linux kernel netfilter ipset component due to a suspicious rcu_dereference_protected() call. When destroying all sets, the kernel may be in a per-network namespace (pernet) exit phase or executing a userspace command. While the userspace command path correctly held the nfnetlink mutex, the pernet exit phase did not, leading to potential RCU-related races. The fix updates ip_set_dereference() to include a check for the 'is_deleted' state of the instance, ensuring proper synchronization during cleanup. This is a local vulnerability that can result in a denial of service (kernel crash).
Affected products
- Linux Linux Kernel 6.1.95, 6.6.35, 6.9.6, 6.10-rc4
Timeline
- 2024-06-17: patched: Initial patch authored by Jozsef Kadlecsik
- 2024-07-12: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1
- https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5
- https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2
- https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a
- https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33
- https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6
- https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4