CVE-2022-49558

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: double hook unregistration in netns path

__nft_release_hooks() is called from pre_netns exit path which

unregisters the hooks, then the NETDEV_UNREGISTER event is triggered

which unregisters the hooks again.

[ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270

[...]

[ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27

[ 565.253682] Workqueue: netns cleanup_net

[ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270

[...]

[ 565.297120] Call Trace:

[ 565.300900] <TASK>

[ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables]

[ 565.308518] raw_notifier_call_chain+0x63/0x80

[ 565.312386] unregister_netdevice_many+0x54f/0xb50

Unregister and destroy netdev hook from netns pre_exit via kfree_rcu

so the NETDEV_UNREGISTER path see unregistered hooks.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References