CVE-2024-35899: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2024-35899

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race between exit_net and the destroy workqueue. The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction. [ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [ 1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ? __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK> [ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750] __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [ 1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953] ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 1360.548994] Freed by task 192222: [ 1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036] __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [ 1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d (gdb) list *__nft_release_table+0x473 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354). 11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11350 list_del(&flowtable->list); 11351 nft_use_dec(&table->use); 11352 nf_tables_flowtable_destroy(flowtable); 11353 } 11354 list_for_each_entry_safe(set, ns, &table->sets, list) { 11355 list_del(&set->list); 11356 nft_use_dec(&table->use); 11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11358 nft_map_deactivat ---truncated---

AI Analysis

Technical Summary

CVE-2024-35899 is a medium-severity vulnerability in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. The vulnerability arises from a race condition between the exit_net path, triggered during module removal, and the destroy workqueue responsible for cleaning up nf_tables data structures. The race leads to a use-after-free condition where nf_tables attempts to access memory that has already been freed. This is evidenced by Kernel Address Sanitizer (KASAN) reports showing slab-use-after-free errors in nf_tables_trans_destroy_work. The root cause is that the pending destroy work is not flushed before exit_net releases the associated nf_tables sets, causing the destroy workqueue to operate on invalid memory references. The vulnerability is related to CWE-362 (Race Condition) and is similar to a previous fix (commit 2c9f0293280e) addressing a related race between exit_net and netlink notifier. Exploitation requires local privileges with low complexity and no user interaction, as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H). The impact primarily affects availability due to potential kernel crashes or denial of service, with limited confidentiality impact. The vulnerability affects specific Linux kernel versions identified by commit hashes, and no known exploits are reported in the wild as of now. The patch details are not provided but the issue is publicly disclosed and fixed in recent kernel updates.

Potential Impact

For European organizations relying on Linux-based systems, especially servers and network infrastructure using netfilter for firewalling and packet filtering, this vulnerability poses a risk of local denial of service. Attackers with low-level access could trigger kernel crashes, leading to service disruptions. This can affect critical infrastructure, cloud services, and enterprise environments where Linux is prevalent. Although the confidentiality and integrity impacts are low, availability degradation can cause operational interruptions, impacting business continuity and service level agreements. Systems running unpatched vulnerable kernel versions are at risk, particularly those that allow local user access or run containerized workloads where privilege escalation might be possible. The vulnerability does not require user interaction but does require local privileges, so insider threats or compromised accounts could exploit it. Given the widespread use of Linux in European data centers, telecom, and government infrastructure, the impact is significant if not mitigated promptly.

Mitigation Recommendations

European organizations should prioritize updating Linux kernels to versions where this vulnerability is patched. Since the vulnerability involves race conditions during module removal and nf_tables cleanup, applying the latest stable kernel releases from trusted distributors (e.g., Debian, Ubuntu, Red Hat, SUSE) is critical. For environments where immediate patching is not feasible, restricting local user privileges to prevent untrusted users from loading or removing kernel modules can reduce risk. Additionally, monitoring kernel logs for KASAN or similar memory error reports can help detect exploitation attempts. Employing kernel lockdown features and mandatory access controls (e.g., SELinux, AppArmor) to limit module management and netfilter manipulation can further harden systems. Network segmentation and limiting access to systems with local user accounts reduce the attack surface. Finally, organizations should maintain an inventory of kernel versions in use and implement automated patch management to ensure timely updates.