REDHAT-BUG-2323953: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: must hold reference on net namespace
BUG: KASAN: slab-use-after-free in nfunregisternethook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpfnflinkrelease+0xda/0x1e0 bpflinkfree+0x139/0x2d0 bpflinkrelease+0x68/0x80 fput+0x414/0xb60
Eric says: It seems that bpf was able to defer the nfunregisternethook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpfnflinkattach() does : link->net = net; But I do not see a reference being taken on net.
Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2323953?
The severity of REDHAT-BUG-2323953 is classified as critical due to a slab-use-after-free vulnerability in the Linux kernel.
How do I fix REDHAT-BUG-2323953?
To fix REDHAT-BUG-2323953, you should apply the latest patches provided for the Linux kernel as indicated by your distribution.
What systems are affected by REDHAT-BUG-2323953?
REDHAT-BUG-2323953 affects systems running specific versions of the Linux kernel that utilize the netfilter BPF hooks.
What does REDHAT-BUG-2323953 vulnerability affect?
REDHAT-BUG-2323953 affects the netfilter subsystem of the Linux kernel, particularly related to network namespace handling.
Is there a workaround for REDHAT-BUG-2323953?
Currently, there are no recommended workarounds for REDHAT-BUG-2323953; the best approach is to update the kernel.