In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: <TASK> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: ctnetlink: corrige uso después de liberación en ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() almacena un puntero conntrack en cb -> data para la devolución de llamada de volcado netlink ctnetlink_exp_ct_dump_table(), pero libera la referencia conntrack inmediatamente después de netlink_dump_start(). Cuando el volcado abarca múltiples rondas, el segundo recvmsg() activa la devolución de llamada de volcado que desreferencia el conntrack ahora liberado a través de nfct_help(ct), lo que lleva a un uso después de liberación en ct -> ext. El error es que netlink_dump_control no tiene devoluciones de llamada .start o .done para gestionar la referencia conntrack a través de las rondas de volcado. Otras funciones de volcado en el mismo archivo (p. ej., ctnetlink_get_conntrack) utilizan correctamente las devoluciones de llamada .start/.done para este propósito. Solucione esto añadiendo devoluciones de llamada .start y .done que retienen y liberan la referencia conntrack durante la duración del volcado, y mueva la llamada a nfct_help() después de la comprobación de retorno anticipado cb -> args[0] en la devolución de llamada de volcado para evitar desreferenciar ct -> ext innecesariamente. ERROR: KASAN: uso después de liberación de slab en ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Lectura de tamaño 8 en la dirección ffff88810597ebf0 por la tarea ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc No contaminado 7.0.0-rc2+ #3 PREEMPTLAZY Traza de Llamada: <TAREA> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Asignado por la tarea 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Liberado por la tarea 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 1.8
Impact Score: 5.9
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a52f6840> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb84880> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a757c180> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a52f78c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a52f4c00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23be9fce40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d24246e7b80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb86700> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d236440fa40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23a52f7700> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424448600> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |