|
| 1 | +# Vulnerability |
| 2 | + |
| 3 | +A use-after-free vulnerability was found in the Linux kernel's Netfilter nf_tables subsystem (`net/netfilter/nf_tables_api.c`). A `break` statement in both `nft_map_catchall_deactivate()` and `nft_map_catchall_activate()` causes incomplete processing when two catchall elements coexist in a verdict map during the same transaction. When the set is also being deleted in the same batch, the `break` causes the second catchall element's chain reference to be mismanaged during the abort path, leading to a `chain->use` counter underflow to zero and a subsequent use-after-free of the `nft_chain` object. This leads to local privilege escalation (LPE). |
| 4 | + |
| 5 | +## Requirements to trigger the vulnerability: |
| 6 | +- Capabilities: To trigger the vulnerability, `CAP_NET_ADMIN` capability is required to access the Netfilter system. |
| 7 | +- Kernel configuration: Kernel configs related to the Netfilter nf_tables system (e.g., `CONFIG_NETFILTER`, `CONFIG_NF_TABLES`) are required to trigger this vulnerability. This config is generally enabled by default (ex. x86_64_defconfig). |
| 8 | +- Are user namespaces needed?: Yes. As this vulnerability requires `CAP_NET_ADMIN`, which is not usually given to the normal user, we used the unprivileged user namespace to achieve this capability. |
| 9 | + |
| 10 | +## Commit which introduced the vulnerability |
| 11 | +- This vulnerability was introduced in Linux v6.4, with commit [628bd3e49cba1c066228e23d71a852c23e26da73](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=628bd3e49cba1c066228e23d71a852c23e26da73) |
| 12 | +- This commit ("netfilter: nf_tables: drop map element references from preparation phase") restructured the handling of map element data references such that a pending `DELSETELEM` and a `NEWSETELEM` in the same batch can both leave catchall elements in the set's `catchall_list` simultaneously, exposing the latent `break`-statement bug in `nft_map_catchall_deactivate()` and `nft_map_catchall_activate()`. |
| 13 | + |
| 14 | +## Commit which fixed the vulnerability |
| 15 | +- This vulnerability was fixed with commit [7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9) ("netfilter: nf_tables: always walk all pending catchall elements"), which removes the `break` statements from both `nft_map_catchall_deactivate()` and `nft_map_catchall_activate()` so that all catchall elements are processed — not just the first matching one — when a verdict map containing multiple pending catchalls is toggled during a transaction. |
| 16 | + |
| 17 | +## Affected kernel versions |
| 18 | +- Linux versions containing commit 628bd3e49cba and lacking the fix ("netfilter: nf_tables: always walk all pending catchall elements") are affected. |
| 19 | + |
| 20 | +## Affected component, subsystem |
| 21 | +- net/netfilter (nf_tables) |
| 22 | + |
| 23 | +## Cause (UAF, BoF, race condition, double free, refcount overflow, etc) |
| 24 | +- Use-after-free (`chain->use` counter underflow to zero via incomplete catchall processing → premature `kfree` of `nft_chain`) |
| 25 | + |
| 26 | +## Which syscalls or syscall parameters are needed to be blocked to prevent triggering the vulnerability? (If there is any easy way to block it.) |
| 27 | +- Disable syscalls for Netfilter (specifically, Netfilter nf_tables) system (ex. `socket`, `sendmsg` with Netlink socket) to prevent this vulnerability. |
| 28 | +- Disable syscalls for unprivileged user namespace (ex. `clone`, `unshare`) can reduce the attack surface since the Netfilter system requires `CAP_NET_ADMIN` to use. |
0 commit comments