In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: unlink table before deleting it
syzbot reports following UAF: BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nla_strcmp+0xf2/0x130 lib/nlattr.c:836 nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570 nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline] nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064 nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
Problem is that all get operations are lockless, so the commit_mutex held by nft_rcv_nl_event() isn't enough to stop a parallel GET request from doing read-accesses to the table object even after synchronize_rcu().
To avoid this, unlink the table first and store the table objects in on-stack scratch space.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade ocfs2-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-rt-extraUpgrade dtb-amdUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-rt-develUpgrade kernel-debug-vdsoUpgrade kernel-syms-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade dtb-renesasUpgrade kernel-default-baseUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kernel-64kb-extraUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-azureUpgrade dtb-mediatekUpgrade kernel-devel-rtUpgrade dtb-rockchipUpgrade dtb-armUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-rt_debug-develUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-azure-develUpgrade kernel-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dtb-broadcomUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-zfcpdumpUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade dtb-marvellUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade dtb-qcomUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-symsUpgrade kernel-azure-optionalUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade kernel-docs-htmlUpgrade dtb-exynosUpgrade kernel-devel | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub