Pablo Neira Ayuso

تم تحديد مشكلة تتعلق بإلغاء تسجيل الخطافات (hooks) مرتين في مكون netfilter nf tables. يتم استدعاء الدالة ` nft release hooks()` من مسار الإخراج pre netns، مما يؤدي إلى إلغاء تسجيل الخطافات. ومع ذلك، يتم تشغيل الحدث NETDEV UNREGISTER بعد ذلك، مما يؤدي إلى إلغاء تسجيل الخطافات مرة أخرى. يرتبط هذه المشكلة برسالة تحذير وبتتبع استدعاء يتضمن الدالة ` nf unregister net hook+0x247/0x270`.

تم تحديد مشكلة تسرب الذاكرة في مكون netfilter nf tables في نواة لينكس. تحدث هذه المشكلة لأن مسار الالتزام (commit) لا يحرر كائنات قواعد التدفق، في حين أن مسار الإلغاء (abort) يقوم بذلك. تم حل هذه المشكلة عن طريق تحديث الكود لتدمير هذه الكائنات قبل تحرير المعاملة.

تم إصلاح ثغرة أمنية في نواة لينكس تتعلق بحجم جدول التجزئة (hash table) الخاص بـ conntrack في netfilter. كان من الممكن أن تؤدي هذه المشكلة إلى ظهور WARN ON ONCE في kvmalloc node noprof() عند تغيير حجم جدول التجزئة، نظرًا لعدم تعريف GFP NOWARN. يتضمن الإصلاح تحديد الحجم الأقصى لجدول التجزئة بقيمة INT MAX. ولا يمكن تغيير حجم جدول التجزئة إلا من خلال init netns.

تحتوي نواة لينكس على ثغرة أمنية في وحدة netfilter، وتحديدًا في الدالة nft set hash، حيث قد تحدث عملية قراءة ذرية غير محاذاة في البنية nft set ext. يحدث هذا عند الوصول إلى الحقل genmask في البنية nft set ext، مما يؤدي إلى قراءة ذرية غير محاذاة. قد تتسبب هذه المشكلة في حدوث خطأ في طلب الترحيل للنواة، مما يؤدي إلى تعطل النظام. لحل هذه المشكلة، يجب محاذاة البنية nft set ext مع حجم الكلمة.

تم تحديد ثغرة محتملة من نوع تعطل التزامن (deadlock) ABBA في نواة Linux، وتحديدًا في وحدة netfilter IDLETIMER. تحدث هذه المشكلة عندما يتم حذف القاعدة الأخيرة التي تشير إلى idletimer معين في نفس الوقت الذي تتم فيه قراءة ملفه في sysfs، مما يؤدي إلى احتمال حدوث تعطل التزامن الدائري. يتم توفير أداة بسيطة لإعادة إنتاج هذه المشكلة، توضح كيف يمكن أن يحدث التعطل. يتم حل الثغرة الأمنية عن طريق تحرير `list mutex` فور إزالة العنصر من القائمة، ثم المضي قدمًا في عملية إلغاء التثبيت.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the `nft inner` component of the Linux kernel, which can lead to a NULL pointer dereference from userspace when mandatory netlink attributes in payload and meta expression are not validated. This can cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the netfilter module in the Linux kernel, specifically with the nft set pipapo function. It can cause a crash when dealing with large batches of elements in a back-to-back add/remove pattern. The removal function does not work correctly if multiple elements share the same key, potentially leading to the wrong element being unmapped and resulting in a crash when the element is retrieved during lookup. The problem arises from the removal happening in two steps: first, looking up the key and marking the element as inactive, and second, removing the element from the set/map. If an element with the same key has timed out or is not active in the next generation, the removal might unmap the wrong element, causing the non-deactivated element to become unreachable and leading to a crash.

The issue is related to an incorrect pppoe tuple in the netfilter component of the Linux kernel. This causes pppoe traffic reaching the ingress path to not match the flowtable entry, as the pppoe header is expected to be at the network header offset. The bug results in a mismatch in the flow table lookup, leading to pppoe packets entering the classical forwarding path.

The issue is related to a potential data-race in the ` nft obj type get()` function in the `nf tables` component of the Linux kernel. This occurs because `nft unregister obj()` can run concurrently with ` nft obj type get()`, and there is no protection when iterating over the `nf tables objects` list in ` nft obj type get()`. This can lead to a potential data-race of the `nf tables objects` list entry. To resolve this, `list for each entry rcu()` is used to iterate over the `nf tables objects` list in ` nft obj type get()`, and `rcu read lock()` is used in the caller `nft obj type get()` to protect the entire type query process.

The vulnerability is related to a slab-use-after-free issue in the `nf tables trans destroy work` function. This issue can be triggered when an element is released via the destroy workqueue while the `exit net` path has already released the set used in the transaction. The vulnerability can be exploited to potentially elevate privileges in the system.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the netfilter component, specifically the nf tables, where a discard table flag update with pending basechain deletion can cause a hook to remain registered in the core after its basechain has been deleted. This occurs when hook unregistration is deferred to the commit phase and combined with hook updates triggered by the table dormant flag. The vulnerability may allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The vulnerability is related to the netfilter component of the Linux kernel, specifically the nf tables module. When the dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in the table. A configuration that allows for an inconsistent state can trigger a warning when trying to unregister a chain that is already unregistered. This issue may be exploited to elevate privileges in the system.

The issue is related to the netfilter component of the Linux kernel, specifically with the nft ct module. It involves insufficient validation of user-input data in the `nft ct expect obj init()` function, which can lead to a denial of service. The vulnerability is addressed by sanitizing layer 3 and 4 protocol numbers in custom expectations, disallowing families other than NFPROTO {IPV4,IPV6,INET}, and disallowing layer 4 protocols with no ports.

The issue is related to a memory leak in the `nf tables updchain` function of the Linux kernel's netfilter component. When `nft netdev register hooks()` fails, the memory associated with `nft stats` is not freed, causing a memory leak. This can lead to a denial of service. The patch fixes the issue by moving `nft stats alloc()` down after `nft netdev register hooks()` succeeds.

The vulnerability is related to the netfilter component in the Linux kernel, specifically with the bridge functionality. It occurs when the conntrack nf confirm logic cannot handle cloned skbs referencing the same nf conn entry, which happens for multicast or broadcast frames on bridges. This can lead to a race condition between the Macvlan broadcast worker and the normal confirm path. To work around this problem, explicit confirmation of the entry at LOCAL IN time is required before the upper layer has a chance to clone the unconfirmed entry. However, this workaround disables NAT and conntrack helpers. An alternative fix would be to add locking to all code parts that deal with unconfirmed packets, but this opens up other problems.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the netfilter component, specifically the nft flow offload function, where the dst is transferred to the flow object, and the route object does not own it anymore. If the flow offload add() function fails, the error path releases the dst twice, leading to a refcount underflow. This can potentially allow an attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use-after-free vulnerability in the Netfilter component of the Linux kernel, specifically in the nft chain filter function. This vulnerability can lead to a local privilege escalation. The problem arises when a stale reference to a netdevice remains in the hook list after a NETDEV UNREGISTER event is reported.

A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the `nft byteorder eval()` function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.

The issue is related to a memory leak in the netfilter nf tables module when more than 255 elements expire. This causes the system to recycle the initial gc container structure and lose track of previous elements. The `nft trans gc space()` function always returns true, preventing the switch to a new gc container structure. This can impact the confidentiality, integrity, and availability of protected information.

The issue is related to the netfilter component of the Linux kernel, specifically the nf tables module. It involves disallowing timeout for anonymous sets, which are never used from userspace. The vulnerability may allow an attacker to cause a denial of service.