Received-SPF: pass (google.com: domain of oss-security-return-30133-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com>
Date: Wed, 8 May 2024 15:22:57 +0200
From: Salvatore Bonaccorso <carnil@debian.org>
To: oss-security@lists.openwall.com
Message-ID: <Zjt8sRn2BjTdAt6t@lorien.valinor.li>
References: <CAAc67N2A1oS+wNkFT-t-xrF8PzSHfk5CekqDNggEhsbUj9WMNA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAAc67N2A1oS+wNkFT-t-xrF8PzSHfk5CekqDNggEhsbUj9WMNA@mail.gmail.com>
Subject: Re: [oss-security] CVE-2024-26925: Linux: nf_tables: locking issue
 in the nf_tables_abort() function

Hi,

On Wed, May 08, 2024 at 12:42:57AM +0800, HexRabbit Chen wrote:
> Hello,
> 
> I found a locking issue in nf_tables set element GC implementation and
> exploited it in kernelCTF. The bug breaks the sequence number assumption
> in set asynchronous GC, which can be used to cause double free, and
> leads to local privilege escalation.
> 
> Introduced in v6.5:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=720344340fb9
> 
> Fixed in v6.9-rc3:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0d459e2ffb54

Should be noted that this though has been backported to stable series:

5.4.262, 5.10.198, 5.15.134, 6.1.56, 6.4.13

but equally the fix in

5.4.274, 5.10.215, 5.15.155, 6.1.86, 6.6.26, 6.8.5.

Regards.
Salvatore