Executive Summary

This vulnerability exists in the Linux kernel's XFRM subsystem, specifically involving the handling of work items related to network namespaces.

A work item called policy_hthresh.work can be queued onto the system workqueue by a XFRM_MSG_NEWSPDINFO request. This work item eventually calls xfrm_hash_rebuild(), which accesses a network namespace structure (struct net) via container_of().

If the network namespace is torn down before this work item runs, the struct net it tries to access may have already been freed. This leads to a use-after-free condition where xfrm_hash_rebuild() dereferences stale memory, potentially causing undefined behavior or crashes.

The fix involves synchronizing the policy_hthresh.work during network namespace teardown to ensure the work cannot outlive the namespace and access freed memory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the Linux kernel dereferencing freed memory, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.

Since it involves race conditions during network namespace teardown, systems using network namespaces extensively (such as containers or virtualized environments) may be more affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves synchronizing the policy_hthresh.work in xfrm_policy_fini() to prevent queued work from accessing freed memory after net namespace teardown.

Since the vulnerability is related to the Linux kernel's XFRM subsystem, applying the latest kernel patches or upgrading to a patched kernel version is the immediate recommended step.

Useful 0 Not Useful 0