netfilter: flowtable: generalize pending status bit
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC. And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions. Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 2c8897953f3b2ff5498f3f275708a742bfcdbc24 · fixed in f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc; From 2c8897953f3b2ff5498f3f275708a742bfcdbc24 · fixed in 4d52b72f3aa68ad0536444e36530bda75070194c; From 2c8897953f3b2ff5498f3f275708a742bfcdbc24 · fixed in 4033e1a9262c57dfbfc594a591a50fcba63c531a; From 2c8897953f3b2ff5498f3f275708a742bfcdbc24 · fixed in a2cac45848d1cf31ed190db30f90ba8211e9a8ca; From 2c8897953f3b2ff5498f3f275708a742bfcdbc24 · fixed in 7c549fb7eecd01fdba7c0d12c01da876ef8a3214
- Linux Linux
5.7
- KernelLinux
From 5.7.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10