CVE-2024-42109

CVE Details

Release Date:

2024-07-30

Description

In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_tables: unconditionally flush pending work before notifier\nsyzbot reports:\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\nnft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\nnft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\nnf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 ('netfilter: nf_tables: do not store nft_ctx in transaction objects'),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat.

See more information about CVE-2024-42109 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12618	2024-09-12
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12618	2024-09-12