CVE-2024-35899

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: flush pending destroy work before exit_net release

Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy

work before netlink notifier") to address a race between exit_net and

the destroy workqueue.

The trace below shows an element to be released via destroy workqueue

while exit_net path (triggered via module removal) has already released

the set that is used in such transaction.

[ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]

[ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465

[ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359

[ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables]

[ 1360.547984] Call Trace:

[ 1360.547991] <TASK>

[ 1360.547998] dump_stack_lvl+0x53/0x70

[ 1360.548014] print_report+0xc4/0x610

[ 1360.548026] ? __virt_addr_valid+0xba/0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References