Linux Kernel Netfilter Vulnerability in Verdict Maps

CVE-2023-52924

Summary

This vulnerability in the Linux kernel's netfilter component relates to a flaw in how the system handles the life cycle of verdict map set elements. When operating with timeouts enabled, a problematic sequence occurs between the set removal in userspace and the kernel's walk processes. If an element in the verdict map has expired, it gets skipped during the list traversal, preventing the update of the chain use count. This oversight can result in a WARN splat when removal is attempted later, ultimately leading to memory leaks and instability within the nft_chain structure. The flaw underscores the importance of appropriate management of element states within the kernel to ensure system integrity.

References