Executive Summary

This vulnerability is a use-after-free bug in the Linux kernel's netfilter component, specifically in the ctnetlink module. The function ctnetlink_dump_exp_ct() improperly manages a connection tracking pointer by storing it for a netlink dump callback but releasing its reference too early. When the dump operation spans multiple rounds, the callback attempts to access the now-freed connection tracking data, leading to a use-after-free condition.

The root cause is that the netlink_dump_control structure lacks proper start and done callbacks to manage the lifetime of the connection tracking reference across multiple dump rounds. Other similar functions correctly use these callbacks to hold and release references. The fix involves adding these callbacks and adjusting the code to avoid dereferencing freed memory.

Useful 0 Not Useful 0

Impact Analysis

This use-after-free vulnerability can lead to memory corruption in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Exploiting this flaw could compromise the security and reliability of systems running vulnerable Linux kernel versions.

Useful 0 Not Useful 0