In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nft_ct: move custom expectation support to helper<\/p>\n
Originally, the ct expectation support called nf_ct_helper_ext_add() for
\nconfirmed conntracks, which is invalid, triggering a splat. This was
\nfixed by commit 1710eb913bdc (“netfilter: nft_ct: skip expectations for
\nconfirmed conntrack”) which restricted it to unconfirmed conntracks.<\/p>\n
However, early insertion of expectations into the expectations list when
\nthe conntrack is unconfirmed leads to stale entries pointing to the
\nwrong hlist_head through .pprev due to ct extension reallocation.<\/p>\n
Commit 7c9664351980 (“netfilter: move nat hlist_head to nf_conn”) moved
\nthe nat hlist_head to nf_conn for this reason:<\/p>\n
1. …
\n 2. When reallocation of extension area occurs we need to fixup the
\n bysource hash head via hlist_replace_rcu.<\/p>\n
I’d rather not increase the size of the struct nf_conn for this feature
\nhas very limited scope: only one expectation can be created at a time
\ngiven expect_clash() will make nf_ct_expect_related() reports EBUSY.
\nFor this reason, relax nf_ct_expect_related() not to drop packets in
\ncase expectation creation fails, therefore, expectation creation becomes
\nbest effort.<\/p>\n
To address this issue, add an internal ct helper and attach it to the
\nconntrack entry to streamline the custom ct expectation support with
\nexisting ct helpers.<\/p>\n
Expose a new nf_conntrack_helper_release() function to release the
\ninternal helper that is allocated and attached to the conntrack entry to
\ncreate the custom expectations. The nft_ct module removal always waits
\nfor rcu grace period, then the NULL helper callback is observed after
\nthis.<\/p>\n
This patch also restricts the creation of expectations to different
\nhelpers other than this custom helper that is created for this type of
\nexpectations.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nft_ct: move custom expectation support to helper<\/p>\n
Originally, the ct expectation support called nf_ct_helper_ext_add() <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25646","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}