CVE-2022-48935

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: unregister flowtable hooks on netns exit<br /> <br /> Unregister flowtable hooks before they are releases via<br /> nf_tables_flowtable_destroy() otherwise hook core reports UAF.<br /> <br /> BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142<br /> Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666<br /> <br /> CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106<br /> dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106<br /> print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247<br /> __kasan_report mm/kasan/report.c:433 [inline]<br /> __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450<br /> kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450<br /> nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142<br /> __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429<br /> nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571<br /> nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232<br /> nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430<br /> nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]<br /> nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]<br /> nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652<br /> nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652<br /> nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652<br /> <br /> __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which<br /> only unregisters the hooks, then after RCU grace period, it is<br /> guaranteed that no packets add new entries to the flowtable (no flow<br /> offload rules and flowtable hooks are reachable from packet path), so it<br /> is safe to call nf_flow_table_free() which cleans up the remaining<br /> entries from the flowtable (both software and hardware) and it unbinds<br /> the flow_block.