HIGH
netfilter Catchall Element UAF
CVE-2023-6111
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630.
02KernelScan AI Analysis
Risk summary
This vulnerability allows local attackers with netfilter configuration privileges to corrupt kernel memory through double-free operations, potentially leading to privilege escalation. The impact is high as it affects core networking security infrastructure, but exploitation requires local access and elevated privileges.
Vulnerability analysis
Summary: A use-after-free vulnerability in netfilter's nf_tables component where catchall set elements could be freed multiple times due to improper cleanup in the garbage collection sync path.
Root Cause: The nft_trans_gc_catchall function failed to remove expired catchall set elements from the catchall_list when operating in sync mode (sync=true). This meant that the same catchall element could be processed multiple times during garbage collection, leading to multiple free operations on the same memory.
Attack Mechanism: An attacker with local access and sufficient privileges to manipulate netfilter rules could trigger the garbage collection of catchall elements in a way that causes the same element to be freed multiple times, corrupting kernel memory and potentially achieving privilege escalation.
Fix Mechanism: The patch fixes the issue by ensuring that in sync mode, expired catchall elements are properly deactivated and removed from the catchall_list before being queued for garbage collection. It introduces proper cleanup by calling nft_setelem_data_deactivate() and nft_setelem_catchall_destroy() (which removes from list) before adding to the GC queue.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| mainline | 6.7 | 93995bf4af2c |