cve/published/2022/CVE-2022-49558.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49558: netfilter: nf_tables: double hook unregistration in netns path

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: double hook unregistration in netns path

__nft_release_hooks() is called from pre_netns exit path which
unregisters the hooks, then the NETDEV_UNREGISTER event is triggered
which unregisters the hooks again.

[  565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270
[...]
[  565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G            E     5.18.0-rc7+ #27
[  565.253682] Workqueue: netns cleanup_net
[  565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270
[...]
[  565.297120] Call Trace:
[  565.300900]  <TASK>
[  565.304683]  nf_tables_flowtable_event+0x16a/0x220 [nf_tables]
[  565.308518]  raw_notifier_call_chain+0x63/0x80
[  565.312386]  unregister_netdevice_many+0x54f/0xb50

Unregister and destroy netdev hook from netns pre_exit via kfree_rcu
so the NETDEV_UNREGISTER path see unregistered hooks.

The Linux kernel CVE team has assigned CVE-2022-49558 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 767d1216bff82507c945e92fe719dff2083bb2f4 and fixed in 4.19.316 with commit c73955a09408e7374d9abfd0e78ce3de9cda0635
	Issue introduced in 5.4.99 with commit b110391d1e806167254d3c7ae5d637191d913175 and fixed in 5.4.262 with commit b09e6ccf0d12f9356e8e3508d3e3dce126298538
	Issue introduced in 5.10.17 with commit 0a0e5d47670b753d3dbf88f3c77a97a30864d9bd and fixed in 5.10.198 with commit 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82
	Issue introduced in 5.11 with commit 767d1216bff82507c945e92fe719dff2083bb2f4 and fixed in 5.15.45 with commit 9c413a8c8bb49cc16796371805ecb260e885bb2b
	Issue introduced in 5.11 with commit 767d1216bff82507c945e92fe719dff2083bb2f4 and fixed in 5.17.13 with commit a3940dcf552f2393d1e8f263b386593f98abe829
	Issue introduced in 5.11 with commit 767d1216bff82507c945e92fe719dff2083bb2f4 and fixed in 5.18.2 with commit 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19
	Issue introduced in 5.11 with commit 767d1216bff82507c945e92fe719dff2083bb2f4 and fixed in 5.19 with commit f9a43007d3f7ba76d5e7f9421094f00f2ef202f8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49558
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_tables_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c73955a09408e7374d9abfd0e78ce3de9cda0635
	https://git.kernel.org/stable/c/b09e6ccf0d12f9356e8e3508d3e3dce126298538
	https://git.kernel.org/stable/c/3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82
	https://git.kernel.org/stable/c/9c413a8c8bb49cc16796371805ecb260e885bb2b
	https://git.kernel.org/stable/c/a3940dcf552f2393d1e8f263b386593f98abe829
	https://git.kernel.org/stable/c/86c0154f4c3a56c5db8b9dd09e3ce885382c2c19
	https://git.kernel.org/stable/c/f9a43007d3f7ba76d5e7f9421094f00f2ef202f8