CVE-2022-48935

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48935
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unregister flowtable hooks on netns exit Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF. BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666 CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106 print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450 kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232 nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nf_flow_table_free() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6069da443bf65f513bb507bb21e2f87cfb1ad0b6 Patch
https://git.kernel.org/stable/c/88c795491bf45a8c08a0f94c9ca4f13722e51013 Patch
https://git.kernel.org/stable/c/8ffb8ac3448845f65634889b051bd65e4dee484b Patch
https://git.kernel.org/stable/c/b05a24cc453e3cd51b0c79e3c583b5d495eba1d6 Patch
https://git.kernel.org/stable/c/b4fcc081e527aa2ce12e956912fc47e251f6bd27 Patch
https://git.kernel.org/stable/c/e51f30826bc5384801df98d76109c94953d1df64 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Aug 2024, 01:45

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/6069da443bf65f513bb507bb21e2f87cfb1ad0b6 - () https://git.kernel.org/stable/c/6069da443bf65f513bb507bb21e2f87cfb1ad0b6 - Patch
References () https://git.kernel.org/stable/c/88c795491bf45a8c08a0f94c9ca4f13722e51013 - () https://git.kernel.org/stable/c/88c795491bf45a8c08a0f94c9ca4f13722e51013 - Patch
References () https://git.kernel.org/stable/c/8ffb8ac3448845f65634889b051bd65e4dee484b - () https://git.kernel.org/stable/c/8ffb8ac3448845f65634889b051bd65e4dee484b - Patch
References () https://git.kernel.org/stable/c/b05a24cc453e3cd51b0c79e3c583b5d495eba1d6 - () https://git.kernel.org/stable/c/b05a24cc453e3cd51b0c79e3c583b5d495eba1d6 - Patch
References () https://git.kernel.org/stable/c/b4fcc081e527aa2ce12e956912fc47e251f6bd27 - () https://git.kernel.org/stable/c/b4fcc081e527aa2ce12e956912fc47e251f6bd27 - Patch
References () https://git.kernel.org/stable/c/e51f30826bc5384801df98d76109c94953d1df64 - () https://git.kernel.org/stable/c/e51f30826bc5384801df98d76109c94953d1df64 - Patch

22 Aug 2024, 12:48

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: anular el registro de los ganchos de la tabla de flujo en la salida de netns. Anular el registro de los ganchos de la tabla de flujo antes de que se publiquen a través de nf_tables_flowtable_destroy(); de lo contrario, enganche los informes centrales UAF. ERROR: KASAN: use-after-free en nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Lectura de tamaño 4 en la dirección ffff8880736f7438 por la tarea syz-executor579/3666 CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Seguimiento de llamadas: __dump_stack lib/dump_stack.c :88 [en línea] __dump_stack lib/dump_stack.c:88 [en línea] lib/dump_stack.c:106 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106 print_address_description+0x65/0x380 mm/kasan /report.c:247 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [en línea] __kasan_report mm/kasan/report.c:433 [en línea] mm/kasan/report.c:450 kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 __nf_register_net_hook+0x27e/ 0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter /nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232 nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430 nfnetlink_rcv_batch net/netfilter/nfnetlink .c:513 [en línea ] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [en línea] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [en línea] net/netfilter/nfnetlink.c:652 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [en línea] neto /netfilter/nfnetlink.c:652 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 __nft_release_hook() llama a nft_unregister_flowtable_net_hooks() que solo cancela el registro de los ganchos, luego, después del período de gracia de RCU, se garantiza que ningún paquete agregue nuevas entradas a la tabla de flujo (no se puede acceder a reglas de descarga de flujo ni a enlaces de tabla de flujo desde la ruta del paquete), por lo que es seguro llamar a nf_flow_table_free() que limpia las entradas restantes de la tabla de flujo (tanto de software como de hardware) y desvincula flow_block.

22 Aug 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-22 04:15

Updated : 2024-08-23 01:45

NVD link : CVE-2022-48935

Mitre link : CVE-2022-48935

CVE.ORG link : CVE-2022-48935

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free