Linux Kernel Vulnerability in Netfilter Affecting Nftables Functionality

CVE-2023-52925

Summary

A vulnerability in the Linux kernel's netfilter component allows for incorrect handling of expired duplicate entries during insertion operations in nftables. This flaw, linked to the mishandling of expired elements, has the potential to disrupt the expected behavior of nftables' element activation and deletion processes, posing risks to system stability and security. Furthermore, the implementation asymmetry observed in nft_pipapo_activate and other element handlers could lead to unintended consequences in how duplicate elements are processed. It is crucial for users to apply the latest updates to ensure that expired entries are properly ignored, maintaining the integrity of the kernel's netfilter functionality.

References