CVE-2024-39503

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type<br /> <br /> Lion Ackermann reported that there is a race condition between namespace cleanup<br /> in ipset and the garbage collection of the list:set type. The namespace<br /> cleanup can destroy the list:set type of sets while the gc of the set type is<br /> waiting to run in rcu cleanup. The latter uses data from the destroyed set which<br /> thus leads use after free. The patch contains the following parts:<br /> <br /> - When destroying all sets, first remove the garbage collectors, then wait<br /> if needed and then destroy the sets.<br /> - Fix the badly ordered "wait then remove gc" for the destroy a single set<br /> case.<br /> - Fix the missing rcu locking in the list:set type in the userspace test<br /> case.<br /> - Use proper RCU list handlings in the list:set type.<br /> <br /> The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).