CVE-2023-52924

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't skip expired elements during walk

There is an asymmetry between commit/abort and preparation phase if the

following conditions are met:

1. set is a verdict map ("1.2.3.4 : jump foo")

2. timeouts are enabled

In this case, following sequence is problematic:

1. element E in set S refers to chain C

2. userspace requests removal of set S

3. kernel does a set walk to decrement chain->use count for all elements

from preparation phase

4. kernel does another set walk to remove elements from the commit phase

(or another walk to do a chain->use increment for all elements from

abort phase)

If E has already expired in 1), it will be ignored during list walk, so its use count

won't have been changed.

Then, when set is culled, ->destroy callback will zap the element via

nf_tables_set_elem_destroy(), but this function is only safe for

elements that have been deactivated earlier from the pre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References