Linux Kernel Circular Lock Dependency in Netfilter

Executive Summary

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in nf_tables. It involves a circular lock dependency between three mutexes: commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex. This circular dependency occurs when nft reset, ipset list, and iptables-nft with the '-m set' rule are run simultaneously.

The issue was caused by the use of commit_mutex in the reset path, which led to this circular locking problem. The vulnerability was resolved by reverting the use of commit_mutex in this context, as previous patches had already made it safe to run individual reset handlers concurrently without requiring commit_mutex.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a circular lock dependency in the Linux kernel's netfilter subsystem, which may lead to deadlocks when certain network filtering operations are performed concurrently. Specifically, running nft reset, ipset list, and iptables-nft with the '-m set' rule at the same time can trigger this condition.

Such deadlocks can cause system hangs or degraded network functionality, potentially impacting system stability and availability.

Useful 0 Not Useful 0