Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid skb access on nf_stolen When verdict is NF_STOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN. Avoid 2 by skipping skb->mark access if verdict is STOLEN. 3 is avoided by precomputing the trace id. Only dump the packet when verdict is not "STOLEN".
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to < 348218a4601e93de4d1e9fab29837cf656e4bf99affected5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to < 453a67af8bd77463b33cb0336dd7f2341e332d29affected5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to < 0016d5d46d7440729a3132f61a8da3bf7f84e2baaffected5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to < e34b9ed96ce3b06c79bf884009b16961ca478f87affected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected5.18.13 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected