CVE-2024-27012

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: restore set elements when delete set fails

From abort path, nft_mapelem_activate() needs to restore refcounters to

the original state. Currently, it uses the set->ops->walk() to iterate

over these set elements. The existing set iterator skips inactive

elements in the next generation, this does not work from the abort path

to restore the original state since it has to skip active elements

instead (not inactive ones).

This patch moves the check for inactive elements to the set iterator

callback, then it reverses the logic for the .activate case which

needs to skip active elements.

Toggle next generation bit for elements when delete set command is

invoked and call nft_clear() from .activate (abort) path to restore the

next generation bit.

The splat below shows an object in mappings memleak:

[43929.457523] ------------[ cut here ]------------

[43929.457532] WARNING: CPU: 0 PID: 1139 at include/n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References