CVE-2024-50212

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

lib: alloc_tag_module_unload must wait for pending kfree_rcu calls

Ben Greear reports following splat:

------------[ cut here ]------------

net/netfilter/nf_nat_core.c:1114 module nf_nat func:nf_nat_register_fn has 256 allocated at module unload

WARNING: CPU: 1 PID: 10421 at lib/alloc_tag.c:168 alloc_tag_module_unload+0x22b/0x3f0

Modules linked in: nf_nat(-) btrfs ufs qnx4 hfsplus hfs minix vfat msdos fat

...

Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020

RIP: 0010:alloc_tag_module_unload+0x22b/0x3f0

codetag_unload_module+0x19b/0x2a0

? codetag_load_module+0x80/0x80

nf_nat module exit calls kfree_rcu on those addresses, but the free

operation is likely still pending by the time alloc_tag checks for leaks.

Wait for outstanding kfree_rcu operations to complete before checking

resolves this warning.

Reproducer:

unshare -n iptables-nft -t nat -A PREROUTING -p tcp

grep nf_nat /proc/a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References