In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate. Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: nf_tables: siempre recorrer todos los elementos catchall pendientes Durante el procesamiento de transacciones podríamos tener más de un elemento catchall: 1 elemento catchall activo y 1 elemento pendiente que viene como parte del nuevo lote. Si el mapa que contiene los elementos catchall también va a desaparecer, es necesario alternar todos los elementos catchall y no solo el primer candidato viable. De lo contrario, obtenemos: ADVERTENCIA: ./include/net/netfilter/nf_tables.h:1281 en nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 1.8
Impact Score: 5.9
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3420b9100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3855b1240> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ac17e00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385056e80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3420b8e00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3420b8f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3423ce400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36acd1e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ac17d00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3420b8fc0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3606a1800> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3423cdc80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |