CVE-2023-4244

Use-after-free in nft_verdict_dump due to a race between set GC and transaction

References

Notes

 carnil> Fixed as well in 6.4.12 for 6.4.y. Needs closer verification
 carnil> which commits are actually needed to fix the issue in stable
 carnil> series.
 carnil> As per 2023-08-30 23185c6aed1f ("netfilter: nft_dynset:
 carnil> disallow object maps") has been backported to all relevant
 carnil> stable series, in particular 4.19.293, 5.10.192, 6.1.47,
 carnil> 6.4.12.

Bugs

Status

Branch	Status
4.19-buster-security	released (4.19.304-1), needed
4.19-upstream-stable	released (4.19.293) [255bb7fd670589c00cb2f8a1353b721306135ca3], needed
5.10-bullseye-security	released (5.10.197-1) [bugfix/all/netfilter-nf_tables-don-t-skip-expired-elements-duri.patch, bugfix/all/netfilter-nf_tables-gc-transaction-api-to-avoid-race.patch, bugfix/all/netfilter-nf_tables-adapt-set-backend-to-use-gc-tran.patch, bugfix/all/netfilter-nft_set_hash-mark-set-element-as-dead-when.patch, bugfix/all/netfilter-nf_tables-remove-busy-mark-and-gc-batch-ap.patch, bugfix/all/netfilter-nf_tables-fix-gc-transaction-races-with-ne.patch, bugfix/all/netfilter-nf_tables-gc-transaction-race-with-netns-d.patch]
5.10-upstream-stable	released (5.10.192) [a7653eaea0a59a6993c62d3653af5c880ce28533], released (5.10.198) [b15ea4017af82011dd55225ce77cce3d4dfc169c, 448be0774882f95a74fa5eb7519761152add601b, 146c76866795553dbc19998f36718d7986ad302b, 77046cb00850e35ba935944b5100996b2ce34bba, 911dd3cdf1083f4c2e7df72aaab486a1d6dbcc0a, 4046f2b56e5a7ba7e123ff961dd51187b8d59e78, dc0b1f019554e601f57e78d8f5c70e59d77e49a5]
6.1-bookworm-security	released (6.1.55-1) [bugfix/all/netfilter-nf_tables-don-t-skip-expired-elements-duri.patch, bugfix/all/netfilter-nf_tables-gc-transaction-api-to-avoid-race.patch, bugfix/all/netfilter-nf_tables-adapt-set-backend-to-use-gc-tran.patch, bugfix/all/netfilter-nft_set_hash-mark-set-element-as-dead-when.patch, bugfix/all/netfilter-nf_tables-remove-busy-mark-and-gc-batch-ap.patch, bugfix/all/netfilter-nf_tables-fix-gc-transaction-races-with-ne.patch, bugfix/all/netfilter-nf_tables-gc-transaction-race-with-netns-d.patch]
6.1-upstream-stable	released (6.1.47) [7148bca63b212fc8e5c2e8374e14cd62b1c8441c], released (6.1.56) [59dab3bf0b8fc08eb802721c0532f13dd89209b8, ea3eb9f2192e4fc33b795673e56c97a21987f868, df650d6a4bf47248261b61ef6b174d7c54034d15, 4ead4f74b3a9162b205f702d72d4a3421356dbc1, 0b9af4860a61f55cf716267b5ae5df34aacc4b39, 41113aa5698ad7a82635bcb747d483e4458d518d, afa584c35065051a11ae3ea3cc105b634053fcd8]
6.6-upstream-stable	unknown
6.8-upstream-stable	unknown
sid	released (6.4.13-1)
upstream	released (6.5-rc6) [24138933b97b055d486e8064b4a1721702442a9b, 5f68718b34a531a556f2f50300ead2862278da26, f6c383b8c31a93752a52697f8430a71dcbc46adf, c92db3030492b8ad1d0faace7a93bbcf53850d0c, a2dd0233cbc4d8a0abb5f64487487ffc9265beb5], released (6.5-rc7) [6a33d8b73dfac0a41f3877894b38082bd0c9a5bc, 02c6c24402bf1c1e986899c14ba22a10b510916b, 23185c6aed1ffb8fc44087880ba2767aba493779]