CVE-2021-47408

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: serialize hash resizes and cleanups

Syzbot was able to trigger the following warning [1]

No repro found by syzbot yet but I was able to trigger similar issue

by having 2 scripts running in parallel, changing conntrack hash sizes,

and:

for j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done

It would take more than 5 minutes for net_namespace structures

to be cleaned up.

This is because nf_ct_iterate_cleanup() has to restart everytime

a resize happened.

By adding a mutex, we can serialize hash resizes and cleanups

and also make get_next_corpse() faster by skipping over empty

buckets.

Even without resizes in the picture, this patch considerably

speeds up network namespace dismantles.

[1]

INFO: task syz-executor.0:8312 can't die for more than 144 seconds.

task:syz-executor.0 state:R running task stack:25672 pid: 8312 ppid: 6573 flags:0x00004006

Call Trace:

context_switch ker

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References