Log in Start free

Vulnerability · Published May 21, 2024 · Assigned by Linux

CVE-2021-47394netfilter: nf_tables: unlink table before deleting it

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unlink table before deleting it syzbot reports following UAF: BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nla_strcmp+0xf2/0x130 lib/nlattr.c:836 nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570 nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline] nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064 nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 Problem is that all get operations are lockless, so the commit_mutex held by nft_rcv_nl_event() isn't enough to stop a parallel GET request from doing read-accesses to the table object even after synchronize_rcu(). To avoid this, unlink the table first and store the table objects in on-stack scratch space.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.14.12-1DEBIAN-CVE-2021-47394
Debian:13linux5.14.12-1DEBIAN-CVE-2021-47394
Debian:14linux5.14.12-1DEBIAN-CVE-2021-47394
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47394
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47394

Affected products (as reported)

VendorProductVersions
Linux Linux 6001a930ce0378b62210d4f83583fc88a903d89d – before f65c73d3aabb87d4353e0bc4a718b5ae8c43fd046001a930ce0378b62210d4f83583fc88a903d89d – before a499b03bf36b0c2e3b958a381d828678ab0ffc5e
Linux Linux 5.12

References