Executive Summary

This vulnerability relates to the Linux kernel's netfilter subsystem, specifically the NAT (Network Address Translation) hooks. The issue involves the improper release of hook operation structures (ops) using the wrong memory freeing method. Historically, this was not a problem because the data path did not use the original nf_hook_ops structures directly. However, starting with Linux kernel version 5.14, the ability to dump active netfilter hooks from userspace was added, which exposed these structures. The NAT hooks are special because they are called indirectly and were previously invisible to the hook dump subsystem. The vulnerability arises because the NAT ops structures need to be released using a deferred method (kfree_rcu) to avoid issues, but this was not done initially. The fix updates the nf_nat_register_fn() function to handle partial exposure of hooks correctly, preventing potential problems in the nfnetlink_hook subsystem.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could lead to improper memory management in the Linux kernel's netfilter NAT subsystem. This might cause instability or crashes in the kernel due to premature freeing of memory structures that are still in use. Since the issue involves kernel hooks exposed to userspace, it could potentially be exploited to cause denial of service or other unexpected behavior in systems relying on netfilter for network packet processing.

Useful 0 Not Useful 0