CVE-2022-50000

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: fix stuck flows on cleanup due to pending work

To clear the flow table on flow table free, the following sequence

normally happens in order:

1) gc_step work is stopped to disable any further stats/del requests.

2) All flow table entries are set to teardown state.

3) Run gc_step which will queue HW del work for each flow table entry.

4) Waiting for the above del work to finish (flush).

5) Run gc_step again, deleting all entries from the flow table.

6) Flow table is freed.

But if a flow table entry already has pending HW stats or HW add work

step 3 will not queue HW del work (it will be skipped), step 4 will wait

for the pending add/stats to finish, and step 5 will queue HW del work

which might execute after freeing of the flow table.

To fix the above, this patch flushes the pending work, then it sets the

teardown flag to all flows in the flowtable and it forces a garbage

collector

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References