CVE-2023-53492

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not ignore genmask when looking up chain by id

When adding a rule to a chain referring to its ID, if that chain had been

deleted on the same batch, the rule might end up referring to a deleted

chain.

This will lead to a WARNING like following:

[ 33.098431] ------------[ cut here ]------------

[ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260

[ 33.099217] Modules linked in:

[ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409

[ 33.099726] Workqueue: events nf_tables_trans_destroy_work

[ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260

[ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7

[ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References