In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: double hook unregistration in netns path
_nftreleasehooks() is called from prenetns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again.
[ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 nfunregisternethook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanupnet [ 565.257059] RIP: 0010:nfunregisternethook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] <TASK> [ 565.304683] nftablesflowtableevent+0x16a/0x220 [nftables] [ 565.308518] rawnotifiercallchain+0x63/0x80 [ 565.312386] unregisternetdevicemany+0x54f/0xb50
Unregister and destroy netdev hook from netns preexit via kfreercu so the NETDEV_UNREGISTER path see unregistered hooks.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-06951fba",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-16f193fb",
"signature_type": "Function",
"digest": {
"function_hash": "332877017084560867860426886388652139903",
"length": 278.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"target": {
"function": "nft_netdev_unregister_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-1d29cad7",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c413a8c8bb49cc16796371805ecb260e885bb2b",
"target": {
"function": "nft_netdev_unregister_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-1df38b65",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"file": "net/netfilter/nft_chain_filter.c"
},
"id": "CVE-2022-49558-245f3aed",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"306536350572720096631235137497515216678",
"120589452649388636614579982839378205302",
"165390343260700480649701888253809160654"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3940dcf552f2393d1e8f263b386593f98abe829",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-2465e733",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90313561273166272261052519647272120839",
"316085571170338738566263407344349551358",
"221265532762800556656628055462285415042",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"312024757651003272408797880634310493307",
"168922137051198616244653700410843332010",
"5059803838984816579147457988543629341",
"277311173283402790682478900445587284548",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"241989927265282098360297681362176169662",
"168758916098232417294830924038981187758",
"195945011381092879478907234601652454834",
"3623139727417696434498035491070664141",
"6226903122622106503081812832407064049",
"181380918542873395417494134484706118833",
"113342615294868901326080709568714625890",
"27676093073675615539287675423200837766",
"8036604984013692496688731090423995299",
"267879554659895141664563741737261183337",
"239629867149333289625189851562886369095",
"49201871029952017395923580585758958871",
"259176772957703450879212873775462383300",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"55000419667126611895147971138156153341",
"110698488950738070218408459696515565929",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"137600804379596780019721511624352621593",
"205580034255670301780826762784571782903",
"153093309258501900963051678958493080916",
"308586319591114580249843091436184976234"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-269bf187",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c413a8c8bb49cc16796371805ecb260e885bb2b",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-2794348b",
"signature_type": "Function",
"digest": {
"function_hash": "200170188694530709527897430104729559217",
"length": 474.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-304b9a96",
"signature_type": "Function",
"digest": {
"function_hash": "200170188694530709527897430104729559217",
"length": 474.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-31922bfe",
"signature_type": "Function",
"digest": {
"function_hash": "200170188694530709527897430104729559217",
"length": 474.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3940dcf552f2393d1e8f263b386593f98abe829",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-39aea142",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"function": "nft_netdev_event",
"file": "net/netfilter/nft_chain_filter.c"
},
"id": "CVE-2022-49558-3f22d3de",
"signature_type": "Function",
"digest": {
"function_hash": "51367484184118971932888508344643129042",
"length": 424.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c413a8c8bb49cc16796371805ecb260e885bb2b",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-4c8d91e6",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-4e4efd81",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-4f64dd12",
"signature_type": "Function",
"digest": {
"function_hash": "332877017084560867860426886388652139903",
"length": 278.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3940dcf552f2393d1e8f263b386593f98abe829",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-5810a27f",
"signature_type": "Function",
"digest": {
"function_hash": "332877017084560867860426886388652139903",
"length": 278.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"function": "nft_unregister_flowtable_net_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-5c9e0de5",
"signature_type": "Function",
"digest": {
"function_hash": "268115904951975162339019830389395013620",
"length": 218.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c413a8c8bb49cc16796371805ecb260e885bb2b",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-5fda11c5",
"signature_type": "Function",
"digest": {
"function_hash": "332877017084560867860426886388652139903",
"length": 278.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3940dcf552f2393d1e8f263b386593f98abe829",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-629fe875",
"signature_type": "Function",
"digest": {
"function_hash": "200170188694530709527897430104729559217",
"length": 474.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-72824085",
"signature_type": "Function",
"digest": {
"function_hash": "332877017084560867860426886388652139903",
"length": 278.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-756e10aa",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90313561273166272261052519647272120839",
"316085571170338738566263407344349551358",
"221265532762800556656628055462285415042",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"312024757651003272408797880634310493307",
"168922137051198616244653700410843332010",
"5059803838984816579147457988543629341",
"277311173283402790682478900445587284548",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"241989927265282098360297681362176169662",
"168758916098232417294830924038981187758",
"195945011381092879478907234601652454834",
"3623139727417696434498035491070664141",
"6226903122622106503081812832407064049",
"181380918542873395417494134484706118833",
"113342615294868901326080709568714625890",
"27676093073675615539287675423200837766",
"87660136636757639714605077642705815098",
"267879554659895141664563741737261183337",
"239629867149333289625189851562886369095",
"49201871029952017395923580585758958871",
"259176772957703450879212873775462383300",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"55000419667126611895147971138156153341",
"110698488950738070218408459696515565929",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"137600804379596780019721511624352621593",
"205580034255670301780826762784571782903",
"153093309258501900963051678958493080916",
"308586319591114580249843091436184976234"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"target": {
"function": "nft_netdev_unregister_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-a9325fad",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"function": "__nft_release_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-cdfa7981",
"signature_type": "Function",
"digest": {
"function_hash": "108532140289968299648381760621489687957",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c413a8c8bb49cc16796371805ecb260e885bb2b",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-d4a89903",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90313561273166272261052519647272120839",
"316085571170338738566263407344349551358",
"221265532762800556656628055462285415042",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"312024757651003272408797880634310493307",
"168922137051198616244653700410843332010",
"5059803838984816579147457988543629341",
"277311173283402790682478900445587284548",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"241989927265282098360297681362176169662",
"168758916098232417294830924038981187758",
"195945011381092879478907234601652454834",
"3623139727417696434498035491070664141",
"6226903122622106503081812832407064049",
"181380918542873395417494134484706118833",
"113342615294868901326080709568714625890",
"27676093073675615539287675423200837766",
"8036604984013692496688731090423995299",
"267879554659895141664563741737261183337",
"239629867149333289625189851562886369095",
"49201871029952017395923580585758958871",
"259176772957703450879212873775462383300",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"55000419667126611895147971138156153341",
"110698488950738070218408459696515565929",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"137600804379596780019721511624352621593",
"205580034255670301780826762784571782903",
"153093309258501900963051678958493080916",
"308586319591114580249843091436184976234"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-d61cab04",
"signature_type": "Function",
"digest": {
"function_hash": "139306845055966910687943057601316375100",
"length": 365.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3940dcf552f2393d1e8f263b386593f98abe829",
"target": {
"function": "nft_netdev_unregister_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-db557678",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"target": {
"function": "nf_tables_unregister_hook",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-e158ffda",
"signature_type": "Function",
"digest": {
"function_hash": "200170188694530709527897430104729559217",
"length": 474.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-e1957450",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"71371827381038207309524027136484142231",
"285777141756014963299628879795888855469",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"184744581640673169978846839713661136181",
"317738746636862082098926770134570492790",
"87188918515128468127934587876382923925",
"222155709724719266366135054471007701623",
"177129288157390375633925430095100762447",
"152602378417810157471654964733666635677",
"256088476270249777776604467198256190881",
"95883939781353091997471059759757295795",
"187076799325898336418543008959693183633",
"234051103201202961000106551689864265411",
"282581190081388929878549120818412476652",
"23681003895878747577194014644712492485",
"26518005427141164594393137435014649739",
"317834549636208184402376266235842695534",
"58807937039752423377327361981595848117",
"301169392578186919358266048850879117878",
"129123865634571314207746737214141822266",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"159081055840189133968628975904999676740",
"175853414287282135948378347901451822979",
"203275943057071116110665895606390566728",
"43642128572911060607628363759332500065"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-e8179609",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90313561273166272261052519647272120839",
"316085571170338738566263407344349551358",
"221265532762800556656628055462285415042",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"312024757651003272408797880634310493307",
"168922137051198616244653700410843332010",
"5059803838984816579147457988543629341",
"277311173283402790682478900445587284548",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"241989927265282098360297681362176169662",
"168758916098232417294830924038981187758",
"195945011381092879478907234601652454834",
"3623139727417696434498035491070664141",
"6226903122622106503081812832407064049",
"181380918542873395417494134484706118833",
"113342615294868901326080709568714625890",
"27676093073675615539287675423200837766",
"8036604984013692496688731090423995299",
"267879554659895141664563741737261183337",
"239629867149333289625189851562886369095",
"49201871029952017395923580585758958871",
"259176772957703450879212873775462383300",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"55000419667126611895147971138156153341",
"110698488950738070218408459696515565929",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"137600804379596780019721511624352621593",
"205580034255670301780826762784571782903",
"153093309258501900963051678958493080916",
"308586319591114580249843091436184976234"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"target": {
"function": "nft_netdev_unregister_hooks",
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-ecd4fad5",
"signature_type": "Function",
"digest": {
"function_hash": "203287016603367602961460212084676255204",
"length": 152.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2022-49558-f1507b28",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90313561273166272261052519647272120839",
"316085571170338738566263407344349551358",
"221265532762800556656628055462285415042",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"312024757651003272408797880634310493307",
"168922137051198616244653700410843332010",
"5059803838984816579147457988543629341",
"277311173283402790682478900445587284548",
"115041770206718593761072850115739472669",
"166179335531436020923604871716745458851",
"241989927265282098360297681362176169662",
"168758916098232417294830924038981187758",
"195945011381092879478907234601652454834",
"3623139727417696434498035491070664141",
"6226903122622106503081812832407064049",
"181380918542873395417494134484706118833",
"113342615294868901326080709568714625890",
"27676093073675615539287675423200837766",
"8036604984013692496688731090423995299",
"267879554659895141664563741737261183337",
"239629867149333289625189851562886369095",
"49201871029952017395923580585758958871",
"259176772957703450879212873775462383300",
"125834192386196710732742965797270183696",
"82701643138871660838355971256554323662",
"131140493096151720535977900032215142791",
"55000419667126611895147971138156153341",
"110698488950738070218408459696515565929",
"259730810998350699642819074749657689505",
"287042979189824134576632227259858962192",
"137600804379596780019721511624352621593",
"205580034255670301780826762784571782903",
"153093309258501900963051678958493080916",
"308586319591114580249843091436184976234"
]
},
"deprecated": false,
"signature_version": "v1"
}
]