netdev - Re: CVE-2024-39503: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZrN2VCc9hM_mahCS@sashalap>
Date: Wed, 7 Aug 2024 09:27:48 -0400
From: Sasha Levin <sashal@...nel.org>
To: Siddh Raman Pant <siddh.raman.pant@...cle.com>
Cc: "stable@...r.kernel.org" <stable@...r.kernel.org>,
	"pablo@...filter.org" <pablo@...filter.org>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: CVE-2024-39503: netfilter: ipset: Fix race between namespace
 cleanup and gc in the list:set type

On Wed, Aug 07, 2024 at 06:42:14AM +0000, Siddh Raman Pant wrote:
>On Fri, 12 Jul 2024 14:21:09 +0200, Greg Kroah-Hartman wrote:
>> In the Linux kernel, the following vulnerability has been resolved:
>>
>> netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
>>
>> Lion Ackermann reported that there is a race condition between namespace cleanup
>> in ipset and the garbage collection of the list:set type. The namespace
>> cleanup can destroy the list:set type of sets while the gc of the set type is
>> waiting to run in rcu cleanup. The latter uses data from the destroyed set which
>> thus leads use after free. The patch contains the following parts:
>>
>> - When destroying all sets, first remove the garbage collectors, then wait
>>   if needed and then destroy the sets.
>> - Fix the badly ordered "wait then remove gc" for the destroy a single set
>>   case.
>> - Fix the missing rcu locking in the list:set type in the userspace test
>>   case.
>> - Use proper RCU list handlings in the list:set type.
>>
>> The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
>
>This commit does not exist in stable kernels. Please backport it.
>
>	netfilter: ipset: Add list flush to cancel_gc
>	
>	Flushing list in cancel_gc drops references to other lists right away,
>	without waiting for RCU to destroy list. Fixes race when referenced
>	ipsets can't be destroyed while referring list is scheduled for destroy.
>
>Since this is missing, the CVE fix potentially introduced new races as
>it makes use of RCU.

Indeed, looks like it was missing on older trees. I'll queue it up.

Thanks!

-- 
Thanks,
Sasha