Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel's networking code. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. This could compromise the security and reliability of systems running vulnerable Linux kernel versions, especially those using bridging and NFQUEUE features.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the nf_queue component. It involves how network packets are handled when they are bridged and queued for processing. The issue arises because the skb->dev field, which points to the network device associated with a packet, can be rewritten from the ingress port to the bridge master device before the packet is queued. However, NFQUEUE only holds references to certain devices, not the bridge master device itself. As a result, a queued packet can retain a reference to a bridge master device that has already been freed.

Later, when the packet verdict is reinjected, the kernel function br_netif_receive_skb() processes the packet with skb->dev still pointing to the freed bridge master device. This triggers a use-after-free condition, which is a type of memory error where the system accesses memory that has already been freed.

The fix involves storing skb->dev in the queue entry and holding a reference to it for the lifetime of the queue, ensuring the device is valid while the packet is queued and processed.

Useful 0 Not Useful 0