In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_tables: don’t queue packet path object notifications<\/p>\n
All file:line references below are against v7.2-rc4 (ac5b0e5651b1). The
\ntrace was captured on 7.2.0-rc6-kasan72rc6 (075b74841bd0), where the same
\nlines apply.<\/p>\n
nft_obj_notify() is exported and reached from the packet path. Its only
\nin-tree caller is nft_quota_obj_eval() (net\/netfilter\/nft_quota.c:68),
\nwhich notifies with GFP_ATOMIC while evaluating a rule for a transiting
\npacket, holding no mutex.<\/p>\n
Since commit 67cc570edaa0 (“netfilter: nf_tables: coalesce multiple
\nnotifications into one skbuff”) that notification is no longer sent
\nimmediately. __nft_obj_notify() queues it onto nft_net->notify_list via
\nnft_notify_enqueue() (net\/netfilter\/nf_tables_api.c:1211), which is a bare
\nlist_add_tail(). notify_list has no lock of its own
\n(include\/net\/netfilter\/nf_tables.h:1951), it is serialised by commit_mutex:
\nthe six other enqueue sites all run inside a netlink transaction, and the
\ndrain in nft_commit_notify() (net\/netfilter\/nf_tables_api.c:10746) does
\nlist_del() + kfree_skb() from nf_tables_commit() with commit_mutex held.<\/p>\n
Sending packets through a chain that references a depleted quota object
\ntherefore races an unlocked list_add_tail() against list_del() +
\nkfree_skb() on another CPU. The WRITE_ONCE(prev->next, new) in __list_add()
\nthen stores through an sk_buff that has already been freed:<\/p>\n
BUG: KASAN: slab-use-after-free in __nft_obj_notify+0x2c5\/0x2d0
\n Write of size 8 at addr ff110001047183c0 by task poc\/76
\n CPU: 0 UID: 1000 PID: 76 Comm: poc Tainted: G W 7.2.0-rc6-kasan72rc6 #4
\n Call Trace:<\/p>\n
__nft_obj_notify (include\/linux\/list.h:164 include\/linux\/list.h:191
\n net\/netfilter\/nf_tables_api.c:1211
\n net\/netfilter\/nf_tables_api.c:8743)
\n nft_quota_obj_eval (net\/netfilter\/nft_quota.c:68)
\n nft_do_chain_inet
\n nf_hook_slow
\n __ip_local_out
\n ip_push_pending_frames
\n udp_send_skb
\n udp_sendmsg
\n __x64_sys_sendto<\/p>\n
Allocated by task 77:
\n __alloc_skb (net\/core\/skbuff.c:704)
\n __nft_obj_notify (include\/net\/netlink.h:1055
\n net\/netfilter\/nf_tables_api.c:8731)
\n nft_quota_obj_eval (net\/netfilter\/nft_quota.c:68)
\n nft_do_chain<\/p>\n
Freed by task 79:
\n nf_tables_commit (include\/linux\/skbuff.h:1332
\n net\/netfilter\/nf_tables_api.c:10759
\n net\/netfilter\/nf_tables_api.c:11185)
\n nfnetlink_rcv_batch (net\/netfilter\/nfnetlink.c:574)
\n netlink_unicast
\n netlink_sendmsg<\/p>\n
The buggy address belongs to the cache skbuff_head_cache of size 232<\/p>\n
Queueing from the packet path is wrong even leaving the race aside:
\nnotify_list is only drained by nft_commit_notify() from nf_tables_commit()
\n(:11185), so a notification enqueued outside a transaction is not sent
\nuntil some later netlink batch commits, if one ever does.<\/p>\n
The gfp argument that nft_obj_notify() still takes is a leftover of the
\npre-67cc570edaa0 behaviour, where this path called nfnetlink_send()
\ndirectly. Restore that: split the message construction out into
\nnft_obj_notify_alloc() and let each caller decide what to do with the skb.
\nnft_obj_notify(), the exported one reached from the packet path, sends it
\nstraight away; nf_tables_obj_notify(), which runs under commit_mutex, keeps
\nqueueing it, so transaction notifications are still coalesced.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_tables: don’t queue packet path object notifications<\/p>\n
All file:line references below are against v7.2-rc4 (ac5b0e5651<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17341","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}