CVE-2024-41042

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: prefer nft_chain_validate

nft_chain_validate already performs loop detection because a cycle will

result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE).

It also follows maps via ->validate callback in nft_lookup, so there

appears no reason to iterate the maps again.

nf_tables_check_loops() and all its helper functions can be removed.

This improves ruleset load time significantly, from 23s down to 12s.

This also fixes a crash bug. Old loop detection code can result in

unbounded recursion:

BUG: TASK stack guard page was hit at ....

Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN

CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1

[..]

with a suitable ruleset during validation of register stores.

I can't see any actual reason to attempt to check for this from

nft_validate_register_store(), at this point the transaction is still in

progress, so we don't have a full picture

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References