linux-cve-announce - CVE-2022-50212: netfilter: nf_tables: do not allow CHAIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061844-CVE-2022-50212-1ff1@gregkh>
Date: Wed, 18 Jun 2025 13:04:37 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50212: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not allow CHAIN_ID to refer to another table

When doing lookups for chains on the same batch by using its ID, a chain
from a different table can be used. If a rule is added to a table but
refers to a chain in a different table, it will be linked to the chain in
table2, but would have expressions referring to objects in table1.

Then, when table1 is removed, the rule will not be removed as its linked to
a chain in table2. When expressions in the rule are processed or removed,
that will lead to a use-after-free.

When looking for chains by ID, use the table that was used for the lookup
by name, and only return chains belonging to that same table.

The Linux kernel CVE team has assigned CVE-2022-50212 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 837830a4b439bfeb86c70b0115c280377c84714b and fixed in 5.10.137 with commit 9e7dcb88ec8e85e4a8ad0ea494ea2f90f32d2583
	Issue introduced in 5.9 with commit 837830a4b439bfeb86c70b0115c280377c84714b and fixed in 5.15.61 with commit 91501513016903077f91033fa5d2aa26cac399b2
	Issue introduced in 5.9 with commit 837830a4b439bfeb86c70b0115c280377c84714b and fixed in 5.18.18 with commit 0f49613a213d918af790c1276f79da741968de11
	Issue introduced in 5.9 with commit 837830a4b439bfeb86c70b0115c280377c84714b and fixed in 5.19.2 with commit 58e863f64ee3d0879297e5e53b646e4b91e59620
	Issue introduced in 5.9 with commit 837830a4b439bfeb86c70b0115c280377c84714b and fixed in 6.0 with commit 95f466d22364a33d183509629d0879885b4f547e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50212
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_tables_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9e7dcb88ec8e85e4a8ad0ea494ea2f90f32d2583
	https://git.kernel.org/stable/c/91501513016903077f91033fa5d2aa26cac399b2
	https://git.kernel.org/stable/c/0f49613a213d918af790c1276f79da741968de11
	https://git.kernel.org/stable/c/58e863f64ee3d0879297e5e53b646e4b91e59620
	https://git.kernel.org/stable/c/95f466d22364a33d183509629d0879885b4f547e