In the Linux kernel, the following vulnerability has been resolved:
netfilter: cttimeout: prevent UAF during module unload
nf_ct_set_timeout() protects the timeout hook dereference and policy lookup
with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net
operations before it clears the hook.
This allows the following interleaving:
CPU 0 CPU 1
cttimeout_exit() nf_ct_set_timeout()
unregister_pernet_subsys() rcu_read_lock()
kfree(pernet) h = nf_ct_timeout_hook
h->timeout_find_get()
nfct_timeout_pernet()
The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the
already freed per-net timeout list. KASAN reported:
BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get
Read of size 8 by task poc/90
Call Trace:
ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]
nf_ct_set_timeout+0x7b/0x3c0
xt_ct_tg_check+0x724/0xb20
xt_check_target+0x234/0xa90
do_ipt_set_ctl+0x570/0x1270
Allocated by task 89:
__kmalloc_noprof+0x16e/0x460
ops_init+0x6d/0x420
register_pernet_operations+0x2f6/0x670
Freed by task 91:
kfree+0x131/0x390
ops_undo_list+0x3d4/0x730
unregister_pernet_operations+0x232/0x490
unregister_pernet_subsys+0x1c/0x30
cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]
Clear the hook and wait for existing readers before unregistering the
per-net operations. This blocks new policy lookups and ensures readers that
observed the hook finish before the per-net storage is freed.
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7
AV:L - The reader that hits freed memory is reached only by a local setsockopt: do_ipt_set_ctl() -> xt_ct_tg_check() -> nf_ct_set_timeout() -> ctnl_timeout_find_get(), installing an iptables CT target with a timeout policy. No packet from a remote peer carries data into this path.
AC:H - The free happens only when cttimeout_exit() runs, i.e. an admin unloading nfnetlink_cttimeout. The attacker must hit the short window between unregister_pernet_subsys() freeing the per-net list and RCU_INIT_POINTER(nf_ct_timeout_hook, NULL). An unprivileged attacker cannot cause that unload.
PR:L - The racing side needs only CAP_NET_ADMIN over the netns, which an unprivileged user gets via unshare -Urn and then installs a CT --timeout rule through iptables set_ctl. The unload is the admin's action, not a privilege the attacker must hold.
UI:N - No victim has to open, mount or run anything on the attacker's behalf. The attacker only needs to be running its setsockopt loop while the module unload happens (already counted in AC:H).
S:U - The use-after-free is in kernel heap memory (the nfct_timeout_pernet list head) inside the same kernel security authority. No VM or hardware isolation boundary is crossed.
C:H - ctnl_timeout_find_get() walks nfct_timeout_list inside the freed per-net storage. If that memory is reallocated with attacker data, the walk follows a fake list to a fake ctnl_timeout, and that pointer is returned to nf_ct_set_timeout(), enabling reads of kernel memory.
I:H - Following a forged list entry, the code increments a refcount on the attacker-chosen object and stores the returned nf_ct_timeout pointer in the conntrack template's timeout extension. That gives a write primitive and a controlled object pointer that can be used for memory corruption.
A:H - Dereferencing freed per-net memory in ctnl_timeout_find_get() produces a KASAN slab-use-after-free (shown in the fix commit), and on production kernels can oops or corrupt the heap and crash the system.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
High |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The reader that hits freed memory is reached only by a local setsockopt: do_ipt_set_ctl() -> xt_ct_tg_check() -> nf_ct_set_timeout() -> ctnl_timeout_find_get(), installing an iptables CT target with a timeout policy. No packet from a remote peer carries data into this path.
AC:H - The free happens only when cttimeout_exit() runs, i.e. an admin unloading nfnetlink_cttimeout. The attacker must hit the short window between unregister_pernet_subsys() freeing the per-net list and RCU_INIT_POINTER(nf_ct_timeout_hook, NULL). An unprivileged attacker cannot cause that unload.
PR:L - The racing side needs only CAP_NET_ADMIN over the netns, which an unprivileged user gets via unshare -Urn and then installs a CT --timeout rule through iptables set_ctl. The unload is the admin's action, not a privilege the attacker must hold.
UI:N - No victim has to open, mount or run anything on the attacker's behalf. The attacker only needs to be running its setsockopt loop while the module unload happens (already counted in AC:H).
S:U - The use-after-free is in kernel heap memory (the nfct_timeout_pernet list head) inside the same kernel security authority. No VM or hardware isolation boundary is crossed.
C:H - ctnl_timeout_find_get() walks nfct_timeout_list inside the freed per-net storage. If that memory is reallocated with attacker data, the walk follows a fake list to a fake ctnl_timeout, and that pointer is returned to nf_ct_set_timeout(), enabling reads of kernel memory.
I:H - Following a forged list entry, the code increments a refcount on the attacker-chosen object and stores the returned nf_ct_timeout pointer in the conntrack template's timeout extension. That gives a write primitive and a controlled object pointer that can be used for memory corruption.
A:H - Dereferencing freed per-net memory in ctnl_timeout_find_get() produces a KASAN slab-use-after-free (shown in the fix commit), and on production kernels can oops or corrupt the heap and crash the system.
CVSS 3.1