cve-2023-52924
Vulnerability from cvelistv5
Published
2025-02-05 09:07
Modified
2025-05-04 07:46
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1.2.3.4 : jump foo") 2. timeouts are enabled In this case, following sequence is problematic: 1. element E in set S refers to chain C 2. userspace requests removal of set S 3. kernel does a set walk to decrement chain->use count for all elements from preparation phase 4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase) If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed. Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase: lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure. Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1da4874d05da1526b11b82fc7f3c7ac38749ddf8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/24138933b97b055d486e8064b4a1721702442a9b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/59dab3bf0b8fc08eb802721c0532f13dd89209b8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7c7e658a36f8b1522bd3586d8137e5f93a25ddc5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/94313a196b44184b5b52c1876da6a537701b425a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b15ea4017af82011dd55225ce77cce3d4dfc169c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bd156ce9553dcaf2d6ee2c825d1a5a1718e86524
Impacted products
Vendor Product Version
Linux Linux Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
Version: 9d0982927e79049675cb6c6c04a0ebb3dad5a434
 Create a notification for this product.
   Linux Linux Version: 4.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "net/netfilter/nf_tables_api.c",
                  "net/netfilter/nft_set_hash.c",
                  "net/netfilter/nft_set_pipapo.c",
                  "net/netfilter/nft_set_rbtree.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "94313a196b44184b5b52c1876da6a537701b425a",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "1da4874d05da1526b11b82fc7f3c7ac38749ddf8",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "b15ea4017af82011dd55225ce77cce3d4dfc169c",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "7c7e658a36f8b1522bd3586d8137e5f93a25ddc5",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "59dab3bf0b8fc08eb802721c0532f13dd89209b8",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "bd156ce9553dcaf2d6ee2c825d1a5a1718e86524",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
                  {
                     lessThan: "24138933b97b055d486e8064b4a1721702442a9b",
                     status: "affected",
                     version: "9d0982927e79049675cb6c6c04a0ebb3dad5a434",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "net/netfilter/nf_tables_api.c",
                  "net/netfilter/nft_set_hash.c",
                  "net/netfilter/nft_set_pipapo.c",
                  "net/netfilter/nft_set_rbtree.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "4.1",
                  },
                  {
                     lessThan: "4.1",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "4.19.*",
                     status: "unaffected",
                     version: "4.19.316",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.4.*",
                     status: "unaffected",
                     version: "5.4.262",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.198",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.134",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.56",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.4.*",
                     status: "unaffected",
                     version: "6.4.11",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.5",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         cpeApplicability: [
            {
               nodes: [
                  {
                     cpeMatch: [
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "4.19.316",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "5.4.262",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "5.10.198",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "5.15.134",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.1.56",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.4.11",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.5",
                           versionStartIncluding: "4.1",
                           vulnerable: true,
                        },
                     ],
                     negate: false,
                     operator: "OR",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: don't skip expired elements during walk\n\nThere is an asymmetry between commit/abort and preparation phase if the\nfollowing conditions are met:\n\n1. set is a verdict map (\"1.2.3.4 : jump foo\")\n2. timeouts are enabled\n\nIn this case, following sequence is problematic:\n\n1. element E in set S refers to chain C\n2. userspace requests removal of set S\n3. kernel does a set walk to decrement chain->use count for all elements\n   from preparation phase\n4. kernel does another set walk to remove elements from the commit phase\n   (or another walk to do a chain->use increment for all elements from\n    abort phase)\n\nIf E has already expired in 1), it will be ignored during list walk, so its use count\nwon't have been changed.\n\nThen, when set is culled, ->destroy callback will zap the element via\nnf_tables_set_elem_destroy(), but this function is only safe for\nelements that have been deactivated earlier from the preparation phase:\nlack of earlier deactivate removes the element but leaks the chain use\ncount, which results in a WARN splat when the chain gets removed later,\nplus a leak of the nft_chain structure.\n\nUpdate pipapo_get() not to skip expired elements, otherwise flush\ncommand reports bogus ENOENT errors.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-05-04T07:46:06.745Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/94313a196b44184b5b52c1876da6a537701b425a",
            },
            {
               url: "https://git.kernel.org/stable/c/1da4874d05da1526b11b82fc7f3c7ac38749ddf8",
            },
            {
               url: "https://git.kernel.org/stable/c/b15ea4017af82011dd55225ce77cce3d4dfc169c",
            },
            {
               url: "https://git.kernel.org/stable/c/7c7e658a36f8b1522bd3586d8137e5f93a25ddc5",
            },
            {
               url: "https://git.kernel.org/stable/c/59dab3bf0b8fc08eb802721c0532f13dd89209b8",
            },
            {
               url: "https://git.kernel.org/stable/c/bd156ce9553dcaf2d6ee2c825d1a5a1718e86524",
            },
            {
               url: "https://git.kernel.org/stable/c/24138933b97b055d486e8064b4a1721702442a9b",
            },
         ],
         title: "netfilter: nf_tables: don't skip expired elements during walk",
         x_generator: {
            engine: "bippy-1.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2023-52924",
      datePublished: "2025-02-05T09:07:55.418Z",
      dateReserved: "2024-08-21T06:07:11.018Z",
      dateUpdated: "2025-05-04T07:46:06.745Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2023-52924\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-05T10:15:21.073\",\"lastModified\":\"2025-02-05T10:15:21.073\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: don't skip expired elements during walk\\n\\nThere is an asymmetry between commit/abort and preparation phase if the\\nfollowing conditions are met:\\n\\n1. set is a verdict map (\\\"1.2.3.4 : jump foo\\\")\\n2. timeouts are enabled\\n\\nIn this case, following sequence is problematic:\\n\\n1. element E in set S refers to chain C\\n2. userspace requests removal of set S\\n3. kernel does a set walk to decrement chain->use count for all elements\\n   from preparation phase\\n4. kernel does another set walk to remove elements from the commit phase\\n   (or another walk to do a chain->use increment for all elements from\\n    abort phase)\\n\\nIf E has already expired in 1), it will be ignored during list walk, so its use count\\nwon't have been changed.\\n\\nThen, when set is culled, ->destroy callback will zap the element via\\nnf_tables_set_elem_destroy(), but this function is only safe for\\nelements that have been deactivated earlier from the preparation phase:\\nlack of earlier deactivate removes the element but leaks the chain use\\ncount, which results in a WARN splat when the chain gets removed later,\\nplus a leak of the nft_chain structure.\\n\\nUpdate pipapo_get() not to skip expired elements, otherwise flush\\ncommand reports bogus ENOENT errors.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1da4874d05da1526b11b82fc7f3c7ac38749ddf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24138933b97b055d486e8064b4a1721702442a9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59dab3bf0b8fc08eb802721c0532f13dd89209b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7c7e658a36f8b1522bd3586d8137e5f93a25ddc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/94313a196b44184b5b52c1876da6a537701b425a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b15ea4017af82011dd55225ce77cce3d4dfc169c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd156ce9553dcaf2d6ee2c825d1a5a1718e86524\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.