Bugzilla – Bug 1217164
VUL-0: CVE-2023-6111: kernel-source,kernel-source-azure,kernel-source-rt: use-after-free vulnerability in nf_tables
Last modified: 2024-05-31 13:06:16 UTC
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6111
Only stable branch contains the buggy commit, but it doesn't have the fixing one
The patch is in v6.7: commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 Author: Pablo Neira Ayuso <pablo@netfilter.org> Date: Mon Nov 6 10:53:09 2023 +0100 netfilter: nf_tables: remove catchall element in GC sync path The expired catchall element is not deactivated and removed from GC sync path. This path holds mutex so just call nft_setelem_data_deactivate() and nft_setelem_catchall_remove() before queueing the GC work. Fixes: 4a9e12ea7e70 ("netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
I think that we can wait the v6.7 be pushed to stable branch.
The fix has landed in upstream stable kernel in 6.6.3 which is in our stable branch. So all should be done, reassigning back to the security team.
All done, closing.