Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure flow_offload_alloc() returns NULL when the conntrack entry is dying (e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation fails; both are expected under load and neither is a kernel bug. This path runs from softirq on every committed packet, so with panic_on_warn=1 an unprivileged user can panic the box just by racing a conntrack flush against a `tc ... action ct commit` classifier. Reproduced with a custom repro under QEMU: a small, fixed set of UDP flows through `tc filter ... action ct commit` on lo, raced against threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined into tcf_ct_act() in this build) within ~15s on the unpatched kernel; same setup is clean on the patched kernel. The fix itself is behavior-preserving: both branches already did `goto err_alloc` before and after, only the WARN is removed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
64ff70b80fd403110b67dd9f7184a604fdb0da43 to < e8fcf3f08834e939b797311742ee72b1e2a08096affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < af475f599270e59313552e6c6f3af8507da672b8affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < 424ba52c0058deeb940d02cba52eb0aeb288db33affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < d512c484bd93a5f2794aa03c9faeb7bcb82dbd4aaffected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < d805560ad69cb266d669341ca01e26bffb0d2c67affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < 00734f3684fcec42c319bedfe68a5d357c720b53affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < 650787233c2fd6e515a7c5f371019a9fa080ccd2affected64ff70b80fd403110b67dd9f7184a604fdb0da43 to < 47abe7a5c4eb53269aca3506446f851572a059a3affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e8fcf3f08834e939b797311742ee72b1e2a08096 ↗
- https://git.kernel.org/stable/c/af475f599270e59313552e6c6f3af8507da672b8 ↗
- https://git.kernel.org/stable/c/424ba52c0058deeb940d02cba52eb0aeb288db33 ↗
- https://git.kernel.org/stable/c/d512c484bd93a5f2794aa03c9faeb7bcb82dbd4a ↗
- https://git.kernel.org/stable/c/d805560ad69cb266d669341ca01e26bffb0d2c67 ↗
- https://git.kernel.org/stable/c/00734f3684fcec42c319bedfe68a5d357c720b53 ↗
- https://git.kernel.org/stable/c/650787233c2fd6e515a7c5f371019a9fa080ccd2 ↗
- https://git.kernel.org/stable/c/47abe7a5c4eb53269aca3506446f851572a059a3 ↗