CVE-2024-42270

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().

We had a report that iptables-restore sometimes triggered null-ptr-deref

at boot time. [0]

The problem is that iptable_nat_table_init() is exposed to user space

before the kernel fully initialises netns.

In the small race window, a user could call iptable_nat_table_init()

that accesses net_generic(net, iptable_nat_net_id), which is available

only after registering iptable_nat_net_ops.

Let's call register_pernet_subsys() before xt_register_template().

[0]:

bpfilter: Loaded bpfilter_umh pid 11702

Started bpfilter

BUG: kernel NULL pointer dereference, address: 0000000000000013

PF: supervisor write access in kernel mode

PF: error_code(0x0002) - not-present page

PGD 0 P4D 0

PREEMPT SMP NOPTI

CPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1

Hardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017

RIP: 0010:ipta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References