In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
Sashiko pointed out that there are a few lockless RCU readers
using test_bit() which is a relaxed atomic operation and
provides no memory barrier guarantees. Use test_bit_acquire()
instead where the operation may run parallel with add/del/gc,
i.e. is not one from the next cases
- protected by region lock
- in a set destroy phase
- in a new/temporary set creation phase
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The vulnerable mtype_test() runs on every packet matched by iptables/nftables xt_set rules in PREROUTING/INPUT/FORWARD, so a remote attacker reaches the bug by sending network traffic to internet-facing servers using ipset-based firewall blocklists.
AC:L - The attacker controls both sides of the race by flooding packets that trigger lockless RCU readers while concurrently driving hash add/del via SET target rules or timeout GC on the same ipset, making the memory-ordering race reliably winnable.
PR:N - No credentials or local access are required on the target; exploitation needs only unauthenticated network packets to a host running ipset netfilter rules, a standard deployment on firewalls, mail servers, and CDN edge nodes.
UI:N - No victim interaction is needed; the attack is fully automated by sending network traffic and does not require mounting filesystems, opening files, or any other user action.
S:U - The vulnerability corrupts or leaks kernel heap data within the same host security boundary; it does not cross VM, container, or IOMMU isolation boundaries.
C:H - Without acquire semantics, test_bit() can observe a slot as used before element writes are visible or after deletion, causing reads of uninitialized, stale, or freed hbucket element and extension memory—a UAF-class kernel information disclosure.
I:H - Stale or torn reads of hash bucket elements during concurrent add/del/gc constitute kernel heap memory safety violations that can corrupt netfilter matching decisions and be further leveraged for control-flow or data manipulation attacks.
A:H - Reading partially initialized or post-destroy hash element memory during softirq packet processing on loaded firewall datapaths can trigger kernel oopses, panics, or hangs, causing complete loss of availability.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The vulnerable mtype_test() runs on every packet matched by iptables/nftables xt_set rules in PREROUTING/INPUT/FORWARD, so a remote attacker reaches the bug by sending network traffic to internet-facing servers using ipset-based firewall blocklists.
AC:L - The attacker controls both sides of the race by flooding packets that trigger lockless RCU readers while concurrently driving hash add/del via SET target rules or timeout GC on the same ipset, making the memory-ordering race reliably winnable.
PR:N - No credentials or local access are required on the target; exploitation needs only unauthenticated network packets to a host running ipset netfilter rules, a standard deployment on firewalls, mail servers, and CDN edge nodes.
UI:N - No victim interaction is needed; the attack is fully automated by sending network traffic and does not require mounting filesystems, opening files, or any other user action.
S:U - The vulnerability corrupts or leaks kernel heap data within the same host security boundary; it does not cross VM, container, or IOMMU isolation boundaries.
C:H - Without acquire semantics, test_bit() can observe a slot as used before element writes are visible or after deletion, causing reads of uninitialized, stale, or freed hbucket element and extension memory—a UAF-class kernel information disclosure.
I:H - Stale or torn reads of hash bucket elements during concurrent add/del/gc constitute kernel heap memory safety violations that can corrupt netfilter matching decisions and be further leveraged for control-flow or data manipulation attacks.
A:H - Reading partially initialized or post-destroy hash element memory during softirq packet processing on loaded firewall datapaths can trigger kernel oopses, panics, or hangs, causing complete loss of availability.
CVSS 3.1