CVE-2024-42109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unconditionally flush pending work before notifier

syzbot reports:

KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831

KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530

KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597

Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45

[..]

Workqueue: events nf_tables_trans_destroy_work

Call Trace:

nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]

nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]

nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597

Problem is that the notifier does a conditional flush, but its possible

that the table-to-be-removed is still referenced by transactions being

processed by the worker, so we need to flush unconditionally.

We could make the flush_work depend on whether we found

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References