CVE-2021-47452

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: skip netdev events generated on netns removal

syzbot reported following (harmless) WARN:

WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468

nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline]

nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline]

__nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524

nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline]

nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382

reproducer:

unshare -n bash -c 'ip link add br0 type bridge; nft add table netdev t ; \

nft add chain netdev t ingress \{ type filter hook ingress device "br0" \

priority 0\; policy drop\; \}'

Problem is that when netns device exit hooks create the UNREGISTER

event, the .pre_exit hook for nf_tables core has already removed the

base hook. Notifier attempts to do this again.

The need to do base

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References