In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: fix refcount leak on table dump
There is a reference count leak in ctnetlink_dump_table():
if (res < 0) {
nf_conntrack_get(&ct->ct_general); // HERE
cb->args[1] = (unsigned long)ct;
...
While its very unlikely, its possible that ct == last.
If this happens, then the refcount of ct was already incremented.
This 2nd increment is never undone.
This prevents the conntrack object from being released, which in turn
keeps prevents cnet->count from dropping back to 0.
This will then block the netns dismantle (or conntrack rmmod) as
nf_conntrack_cleanup_net_list() will wait forever.
This can be reproduced by running conntrack_resize.sh selftest in a loop.
It takes ~20 minutes for me on a preemptible kernel on average before
I see a runaway kworker spinning in nf_conntrack_cleanup_net_list.
One fix would to change this to:
if (res < 0) {
if (ct != last)
nf_conntrack_get(&ct->ct_general);
But this reference counting isn't needed in the first place.
We can just store a cookie value instead.
A followup patch will do the same for ctnetlink_exp_dump_table,
it looks to me as if this has the same problem and like
ctnetlink_dump_table, we only need a 'skip hint', not the actual
object so we can apply the same cookie strategy there as well.
CVSS
5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
from d205dc40798d97d63ad348bfaf7394f445d152d4 before 586892e341fbf698e7cbaca293e1353957db725a; from d205dc40798d97d63ad348bfaf7394f445d152d4 before 962518c6ca9f9a13df099cafa429f72f68ad61f0; from d205dc40798d97d63ad348bfaf7394f445d152d4 before 19b909a4b1452fb97e477d2f08b97f8d04095619; from d205dc40798d97d63ad348bfaf7394f445d152d4 before 41462f4cfc583513833f87f9ee55d12da651a7e3; from d205dc40798d97d63ad348bfaf7394f445d152d4 before 30cf811058552b8cd0e98dff677ef3f89d6d34ce; from d205dc40798d97d63ad348bfaf7394f445d152d4 before a2cb4df7872de069f809de2f076ec8e54d649fe3; from d205dc40798d97d63ad348bfaf7394f445d152d4 before e14f72aa66c029db106921d621edcedef68e065b; from d205dc40798d97d63ad348bfaf7394f445d152d4 before a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b; and 1 more ranges
from 2.6.19 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; and 5 more ranges
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
