In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: unlink table before deleting it
syzbot reports following UAF: BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nla_strcmp+0xf2/0x130 lib/nlattr.c:836 nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570 nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline] nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064 nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
Problem is that all get operations are lockless, so the commit_mutex held by nft_rcv_nl_event() isn't enough to stop a parallel GET request from doing read-accesses to the table object even after synchronize_rcu().
To avoid this, unlink the table first and store the table objects in on-stack scratch space.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade dtb-nvidiaUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade dtb-amdUpgrade kernel-rt_debugUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-debug-develUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-rockchipUpgrade kernel-debug-vdsoUpgrade dtb-appleUpgrade dtb-sprdUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-xilinxUpgrade kernel-azure-livepatch-develUpgrade dtb-alteraUpgrade kernel-develUpgrade kernel-macrosUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-syms-azureUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade dtb-amlogicUpgrade kernel-azure-optionalUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-default-develUpgrade dtb-caviumUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-kvmsmallUpgrade gfs2-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-default-base-rebuildUpgrade kernel-source-azureUpgrade kernel-azure-extraUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-broadcomUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-defaultUpgrade dtb-marvellUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade kernel-default-extraUpgrade kernel-64kb-livepatch-develUpgrade dtb-qcomUpgrade kernel-64kb-devel | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub