CVE-2021-47394

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unlink table before deleting it

syzbot reports following UAF:

BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955

nla_strcmp+0xf2/0x130 lib/nlattr.c:836

nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570

nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline]

nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064

nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285

netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504

Problem is that all get operations are lockless, so the commit_mutex

held by nft_rcv_nl_event() isn't enough to stop a parallel GET request

from doing read-accesses to the table object even after synchronize_rcu().

To avoid this, unlink the table first and store the table objects in

on-stack scratch space.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References