In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: do not allow SETID to refer to another table
When doing lookups for sets on the same batch by using its ID, a set from a different table can be used.
Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free.
When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table.
This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faafd9286f1355c76fe9ac3021c280297213330e",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-03d967e6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"229924787231434920276395606771233596153",
"294998670481968445032344454450957022531",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77d3b5038b7462318f5183e2ad704b01d57215a2",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-1fb195b3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"41382693418714258080451124508709143567",
"117453474822673056843095061921733512411",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faafd9286f1355c76fe9ac3021c280297213330e",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-20ac7233",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77d3b5038b7462318f5183e2ad704b01d57215a2",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-20d1e914",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4fa03410f7c5f5bd8f90e9c11e9a8c4b526ff6f",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-36a6887b",
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "163382905825431542043819723404854604924"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a4b18b1ff11ba26f9a852019d674fde9d1d1cff",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-39920c31",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"41382693418714258080451124508709143567",
"117453474822673056843095061921733512411",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fab2f61cc3b0e441b1749f017cfee75f9bbaded7",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-3a6b7693",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"41382693418714258080451124508709143567",
"117453474822673056843095061921733512411",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-5798c3ed",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-77b6bcbb",
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "163382905825431542043819723404854604924"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fab2f61cc3b0e441b1749f017cfee75f9bbaded7",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-7cadf9e2",
"signature_type": "Function",
"digest": {
"length": 398.0,
"function_hash": "91713203004539776219844262297658554547"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d07039397527361850c554c192e749cfc879ea9",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-9310bb74",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"229924787231434920276395606771233596153",
"294998670481968445032344454450957022531",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fab2f61cc3b0e441b1749f017cfee75f9bbaded7",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-adbb5310",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faafd9286f1355c76fe9ac3021c280297213330e",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-b3451540",
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "163382905825431542043819723404854604924"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a4b18b1ff11ba26f9a852019d674fde9d1d1cff",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-cdbd0a53",
"signature_type": "Function",
"digest": {
"length": 398.0,
"function_hash": "91713203004539776219844262297658554547"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d07039397527361850c554c192e749cfc879ea9",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-d13c7386",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4fa03410f7c5f5bd8f90e9c11e9a8c4b526ff6f",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-d9c270a9",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4fa03410f7c5f5bd8f90e9c11e9a8c4b526ff6f",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-ead91640",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"229924787231434920276395606771233596153",
"294998670481968445032344454450957022531",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d07039397527361850c554c192e749cfc879ea9",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-eec7e5d6",
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "163382905825431542043819723404854604924"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77d3b5038b7462318f5183e2ad704b01d57215a2",
"target": {
"function": "nft_set_lookup_byid",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-f5edfc63",
"signature_type": "Function",
"digest": {
"length": 398.0,
"function_hash": "91713203004539776219844262297658554547"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a4b18b1ff11ba26f9a852019d674fde9d1d1cff",
"target": {
"function": "nft_set_lookup_global",
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-fc1523cb",
"signature_type": "Function",
"digest": {
"length": 293.0,
"function_hash": "21903240764363895204493583127500714797"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50213-fd52f012",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178442308655451211948392149689417719844",
"117149165961022380346326490269263394216",
"313168014785198279362585399102843660760",
"229924787231434920276395606771233596153",
"294998670481968445032344454450957022531",
"117132720545455340317757678634219396586",
"206500375665402241308877743767832494054",
"175513007278688693843260191831668733970",
"217868357073307586005605402901405621763",
"258392852129542066818650398590421238606",
"127979305907651713475980003553223951937",
"127866472815230489675043690706431550353"
]
}
}
]