CVE-2024-35900
Assigner: Linux
Published: 2024-05-19T08:34:54.016Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject new basechain after table flag update

When dormant flag is toggled, hooks are disabled in the commit phase by
iterating over current chains in table (existing and new).

The following configuration allows for an inconsistent state:

  add table x
  add chain x y { type filter hook input priority 0; }
  add table x { flags dormant; }
  add chain x w { type filter hook input priority 1; }

which triggers the following warning when trying to unregister chain w
which is already unregistered.

[  127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50                                                                     1 __nf_unregister_net_hook+0x21a/0x260
[...]
[  127.322519] Call Trace:
[  127.322521]  <TASK>
[  127.322524]  ? __warn+0x9f/0x1a0
[  127.322531]  ? __nf_unregister_net_hook+0x21a/0x260
[  127.322537]  ? report_bug+0x1b1/0x1e0
[  127.322545]  ? handle_bug+0x3c/0x70
[  127.322552]  ? exc_invalid_op+0x17/0x40
[  127.322556]  ? asm_exc_invalid_op+0x1a/0x20
[  127.322563]  ? kasan_save_free_info+0x3b/0x60
[  127.322570]  ? __nf_unregister_net_hook+0x6a/0x260
[  127.322577]  ? __nf_unregister_net_hook+0x21a/0x260
[  127.322583]  ? __nf_unregister_net_hook+0x6a/0x260
[  127.322590]  ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables]
[  127.322655]  nft_table_disable+0x75/0xf0 [nf_tables]
[  127.322717]  nf_tables_commit+0x2571/0x2620 [nf_tables]
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: e10f661adc55
lessThan: 41bad13c0e8a
status: affected
versionType: git
version: d9c4da8cb74e
lessThan: 7b6fba691871
status: affected
versionType: git
version: 179d9ba5559a
lessThan: 8ba81dca416a
status: affected
versionType: git
version: 179d9ba5559a
lessThan: 745cf6a84389
status: affected
versionType: git
version: 179d9ba5559a
lessThan: 420132bee3d0
status: affected
versionType: git
version: 179d9ba5559a
lessThan: e95bb4cba94c
status: affected
versionType: git
version: 179d9ba5559a
lessThan: 994209ddf4f4
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.13
status: affected
version: 0
lessThan: 5.13
status: unaffected
versionType: custom
version: 5.4.274
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.215
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.154
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.85
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.26
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.8.5
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: netfilter: nf_tables: reject new basechain after table flag update
x_generator: engine: bippy-d175d3acf727