CVE-2022-50212: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: do not allow CHAINID to refer to another table
When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain in a different table, it will be linked to the chain in table2, but would have expressions referring to objects in table1.
Then, when table1 is removed, the rule will not be removed as its linked to a chain in table2. When expressions in the rule are processed or removed, that will lead to a use-after-free.
When looking for chains by ID, use the table that was used for the lookup by name, and only return chains belonging to that same table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50212?
CVE-2022-50212 has a medium severity rating due to potential misuse of chain IDs across different tables.
How do I fix CVE-2022-50212?
To fix CVE-2022-50212, update your Linux kernel to the latest version where the vulnerability is resolved.
What is the impact of CVE-2022-50212?
The impact of CVE-2022-50212 is that it could allow for unintended chain rule lookups, leading to possible access control issues.
Which versions of the Linux kernel are affected by CVE-2022-50212?
CVE-2022-50212 affects multiple versions of the Linux kernel that do not have the latest security patches applied.
Is CVE-2022-50212 being actively exploited?
As of the current date, there is no public indication that CVE-2022-50212 is being actively exploited, but it should still be addressed promptly.