CVE-2024-42270

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().<br /> <br /> We had a report that iptables-restore sometimes triggered null-ptr-deref<br /> at boot time. [0]<br /> <br /> The problem is that iptable_nat_table_init() is exposed to user space<br /> before the kernel fully initialises netns.<br /> <br /> In the small race window, a user could call iptable_nat_table_init()<br /> that accesses net_generic(net, iptable_nat_net_id), which is available<br /> only after registering iptable_nat_net_ops.<br /> <br /> Let&amp;#39;s call register_pernet_subsys() before xt_register_template().<br /> <br /> [0]:<br /> bpfilter: Loaded bpfilter_umh pid 11702<br /> Started bpfilter<br /> BUG: kernel NULL pointer dereference, address: 0000000000000013<br /> PF: supervisor write access in kernel mode<br /> PF: error_code(0x0002) - not-present page<br /> PGD 0 P4D 0<br /> PREEMPT SMP NOPTI<br /> CPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1<br /> Hardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017<br /> RIP: 0010:iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat<br /> Code: 10 4c 89 f6 48 89 ef e8 0b 19 bb ff 41 89 c4 85 c0 75 38 41 83 c7 01 49 83 c6 28 41 83 ff 04 75 dc 48 8b 44 24 08 48 8b 0c 24 89 08 4c 89 ef e8 a2 3b a2 cf 48 83 c4 10 44 89 e0 5b 5d 41 5c<br /> RSP: 0018:ffffbef902843cd0 EFLAGS: 00010246<br /> RAX: 0000000000000013 RBX: ffff9f4b052caa20 RCX: ffff9f4b20988d80<br /> RDX: 0000000000000000 RSI: 0000000000000064 RDI: ffffffffc04201c0<br /> RBP: ffff9f4b29394000 R08: ffff9f4b07f77258 R09: ffff9f4b07f77240<br /> R10: 0000000000000000 R11: ffff9f4b09635388 R12: 0000000000000000<br /> R13: ffff9f4b1a3c6c00 R14: ffff9f4b20988e20 R15: 0000000000000004<br /> FS: 00007f6284340000(0000) GS:ffff9f51fe280000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000013 CR3: 00000001d10a6005 CR4: 00000000007706e0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)<br /> ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)<br /> ? xt_find_table_lock (net/netfilter/x_tables.c:1259)<br /> ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420)<br /> ? page_fault_oops (arch/x86/mm/fault.c:727)<br /> ? exc_page_fault (./arch/x86/include/asm/irqflags.h:40 ./arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1470 arch/x86/mm/fault.c:1518)<br /> ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570)<br /> ? iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat<br /> xt_find_table_lock (net/netfilter/x_tables.c:1259)<br /> xt_request_find_table_lock (net/netfilter/x_tables.c:1287)<br /> get_info (net/ipv4/netfilter/ip_tables.c:965)<br /> ? security_capable (security/security.c:809 (discriminator 13))<br /> ? ns_capable (kernel/capability.c:376 kernel/capability.c:397)<br /> ? do_ipt_get_ctl (net/ipv4/netfilter/ip_tables.c:1656)<br /> ? bpfilter_send_req (net/bpfilter/bpfilter_kern.c:52) bpfilter<br /> nf_getsockopt (net/netfilter/nf_sockopt.c:116)<br /> ip_getsockopt (net/ipv4/ip_sockglue.c:1827)<br /> __sys_getsockopt (net/socket.c:2327)<br /> __x64_sys_getsockopt (net/socket.c:2342 net/socket.c:2339 net/socket.c:2339)<br /> do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:81)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> RIP: 0033:0x7f62844685ee<br /> Code: 48 8b 0d 45 28 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 09<br /> RSP: 002b:00007ffd1f83d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000037<br /> RAX: ffffffffffffffda RBX: 00007ffd1f83d680 RCX: 00007f62844685ee<br /> RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004<br /> RBP: 0000000000000004 R08: 00007ffd1f83d670 R09: 0000558798ffa2a0<br /> R10: 00007ffd1f83d680 R11: 0000000000000246 R12: 00007ffd1f83e3b2<br /> R13: 00007f6284<br /> ---truncated---