CVE-2024-56655

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not defer rule destruction via call_rcu

nf_tables_chain_destroy can sleep, it can't be used from call_rcu

callbacks.

Moreover, nf_tables_rule_release() is only safe for error unwinding,

while transaction mutex is held and the to-be-desroyed rule was not

exposed to either dataplane or dumps, as it deactives+frees without

the required synchronize_rcu() in-between.

nft_rule_expr_deactivate() callbacks will change ->use counters

of other chains/sets, see e.g. nft_lookup .deactivate callback, these

must be serialized via transaction mutex.

Also add a few lockdep asserts to make this more explicit.

Calling synchronize_rcu() isn't ideal, but fixing this without is hard

and way more intrusive. As-is, we can get:

WARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x..

Workqueue: events nf_tables_trans_destroy_work

RIP: 0010:nft_set_destroy+0x3fe/0x5c0

Call Trace:

<TASK>

nf_tables_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References