In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nft_flow_offload: drop flowtable reference on init error path<\/p>\n
nft_flow_offload_init() bumps the flowtable use count with
\nnft_use_inc() before calling nf_ct_netns_get(). When the latter
\nfails, the error is returned as-is and the reference is leaked.<\/p>\n
The upper layers do not balance it either: nf_tables_newexpr()
\nclears expr->ops when the expression init callback fails, so the
\nnft_expr_more() iteration in nft_rule_expr_deactivate() and
\nnf_tables_rule_destroy() stops right before the failed expression
\nand its ->destroy callback, which would drop the reference, never
\nruns.<\/p>\n
Each failed rule addition therefore leaks one flowtable reference
\nand the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE
\nkeeps reporting -EBUSY even though no rule references it.<\/p>\n
Save the nf_ct_netns_get() return value and undo the nft_use_inc()
\nwhen it fails, restoring the inc\/dec pairing within
\nnft_flow_offload_init() itself.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nft_flow_offload: drop flowtable reference on init error path<\/p>\n
nft_flow_offload_init() bumps the flowtable use count wit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41323","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}