In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selftests fail: run-tests.sh testcases/sets/0044intervaloverlap0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044intervaloverlap0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nftpipapoactivate:
It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nftpipaporemove fetches elem->priv, then does a relookup, remove this.
I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback.
In first two cases expired elements must be skipped.
For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error.
[
{
"id": "CVE-2023-52925-015e7a24",
"digest": {
"function_hash": "325761354113893679421838361900699483012",
"length": 348.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-0617e6c2",
"digest": {
"function_hash": "40768845345004800933822274960623587644",
"length": 1059.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_remove",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-13ae9ce6",
"digest": {
"function_hash": "200938743672450605778757137187470390188",
"length": 269.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_activate",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-30cddf20",
"digest": {
"function_hash": "166365330826119468837678344004715500192",
"length": 1256.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-3bd7cf4a",
"digest": {
"function_hash": "200938743672450605778757137187470390188",
"length": 269.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_activate",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-50c0ecfc",
"digest": {
"function_hash": "40768845345004800933822274960623587644",
"length": 1059.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_remove",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-688f3eff",
"digest": {
"function_hash": "166365330826119468837678344004715500192",
"length": 1256.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-720f1402",
"digest": {
"function_hash": "166365330826119468837678344004715500192",
"length": 1256.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-8a005c32",
"digest": {
"function_hash": "166365330826119468837678344004715500192",
"length": 1256.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-8c27d7f7",
"digest": {
"function_hash": "200938743672450605778757137187470390188",
"length": 269.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_activate",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-9194401f",
"digest": {
"function_hash": "325761354113893679421838361900699483012",
"length": 348.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-9d4c4421",
"digest": {
"function_hash": "200938743672450605778757137187470390188",
"length": 269.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_activate",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-9fbe4706",
"digest": {
"line_hashes": [
"18450126200245501346610813786440128730",
"143305370865365886841666885255216717227",
"250679631463517267708042436348395558378",
"250553916107176745983083347008827387659",
"58005933470820188500748819879498336996",
"38748976874673614083111366367963363909",
"69306701867235603578437752540162231854",
"27049818398871776726792179890787271100",
"239480119482490245670011841179229516237",
"204445958656384142548175792818889367026",
"2293840841847362166573503950226599051",
"241486783787671794707878224107498792243",
"234922986411736396990808943458183270145",
"133447047865747649337348351147452777963",
"296253052747206572294985417704943946671",
"152819930465334272050851702570251795814",
"207776637245864579636973418813845880535",
"247326417340638207882348321134312670377",
"172131508687723068962668990095793505307",
"128929424294162730225536411960257164893",
"42655862974744660471878333937242705176",
"156679441450492502625747075629338799934",
"293960004471387844996732516040301622448",
"165572860365956362724095114582633661314",
"6329721336339614758874166150893657249",
"3078102544062763670223238309588200736",
"231597389200083367665786542620613269064",
"123283576543467431374380698606046982788"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3",
"signature_type": "Line"
},
{
"id": "CVE-2023-52925-a675199c",
"digest": {
"function_hash": "40768845345004800933822274960623587644",
"length": 1059.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_remove",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-ae148f77",
"digest": {
"line_hashes": [
"18450126200245501346610813786440128730",
"143305370865365886841666885255216717227",
"250679631463517267708042436348395558378",
"250553916107176745983083347008827387659",
"58005933470820188500748819879498336996",
"38748976874673614083111366367963363909",
"69306701867235603578437752540162231854",
"27049818398871776726792179890787271100",
"239480119482490245670011841179229516237",
"204445958656384142548175792818889367026",
"2293840841847362166573503950226599051",
"241486783787671794707878224107498792243",
"234922986411736396990808943458183270145",
"133447047865747649337348351147452777963",
"296253052747206572294985417704943946671",
"152819930465334272050851702570251795814",
"207776637245864579636973418813845880535",
"247326417340638207882348321134312670377",
"172131508687723068962668990095793505307",
"128929424294162730225536411960257164893",
"42655862974744660471878333937242705176",
"156679441450492502625747075629338799934",
"293960004471387844996732516040301622448",
"165572860365956362724095114582633661314",
"6329721336339614758874166150893657249",
"3078102544062763670223238309588200736",
"231597389200083367665786542620613269064",
"123283576543467431374380698606046982788"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188",
"signature_type": "Line"
},
{
"id": "CVE-2023-52925-b128cbfb",
"digest": {
"function_hash": "325761354113893679421838361900699483012",
"length": 348.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-b840018d",
"digest": {
"function_hash": "40768845345004800933822274960623587644",
"length": 1059.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_remove",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-c393c732",
"digest": {
"line_hashes": [
"18450126200245501346610813786440128730",
"143305370865365886841666885255216717227",
"250679631463517267708042436348395558378",
"250553916107176745983083347008827387659",
"58005933470820188500748819879498336996",
"38748976874673614083111366367963363909",
"69306701867235603578437752540162231854",
"27049818398871776726792179890787271100",
"239480119482490245670011841179229516237",
"204445958656384142548175792818889367026",
"2293840841847362166573503950226599051",
"241486783787671794707878224107498792243",
"234922986411736396990808943458183270145",
"133447047865747649337348351147452777963",
"296253052747206572294985417704943946671",
"152819930465334272050851702570251795814",
"207776637245864579636973418813845880535",
"247326417340638207882348321134312670377",
"172131508687723068962668990095793505307",
"128929424294162730225536411960257164893",
"42655862974744660471878333937242705176",
"156679441450492502625747075629338799934",
"293960004471387844996732516040301622448",
"165572860365956362724095114582633661314",
"6329721336339614758874166150893657249",
"3078102544062763670223238309588200736",
"231597389200083367665786542620613269064",
"123283576543467431374380698606046982788"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8",
"signature_type": "Line"
},
{
"id": "CVE-2023-52925-c51e7d28",
"digest": {
"function_hash": "325761354113893679421838361900699483012",
"length": 348.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-c633b90e",
"digest": {
"function_hash": "166365330826119468837678344004715500192",
"length": 1256.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-c72173da",
"digest": {
"line_hashes": [
"18450126200245501346610813786440128730",
"143305370865365886841666885255216717227",
"250679631463517267708042436348395558378",
"250553916107176745983083347008827387659",
"58005933470820188500748819879498336996",
"38748976874673614083111366367963363909",
"69306701867235603578437752540162231854",
"27049818398871776726792179890787271100",
"239480119482490245670011841179229516237",
"204445958656384142548175792818889367026",
"2293840841847362166573503950226599051",
"241486783787671794707878224107498792243",
"234922986411736396990808943458183270145",
"133447047865747649337348351147452777963",
"296253052747206572294985417704943946671",
"152819930465334272050851702570251795814",
"207776637245864579636973418813845880535",
"247326417340638207882348321134312670377",
"172131508687723068962668990095793505307",
"128929424294162730225536411960257164893",
"42655862974744660471878333937242705176",
"156679441450492502625747075629338799934",
"293960004471387844996732516040301622448",
"165572860365956362724095114582633661314",
"6329721336339614758874166150893657249",
"3078102544062763670223238309588200736",
"231597389200083367665786542620613269064",
"123283576543467431374380698606046982788"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4",
"signature_type": "Line"
},
{
"id": "CVE-2023-52925-d61f4691",
"digest": {
"function_hash": "325761354113893679421838361900699483012",
"length": 348.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_get",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-e67bf40a",
"digest": {
"function_hash": "40768845345004800933822274960623587644",
"length": 1059.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_remove",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884",
"signature_type": "Function"
},
{
"id": "CVE-2023-52925-ef550f47",
"digest": {
"line_hashes": [
"18450126200245501346610813786440128730",
"143305370865365886841666885255216717227",
"250679631463517267708042436348395558378",
"250553916107176745983083347008827387659",
"58005933470820188500748819879498336996",
"38748976874673614083111366367963363909",
"69306701867235603578437752540162231854",
"27049818398871776726792179890787271100",
"239480119482490245670011841179229516237",
"204445958656384142548175792818889367026",
"2293840841847362166573503950226599051",
"241486783787671794707878224107498792243",
"234922986411736396990808943458183270145",
"133447047865747649337348351147452777963",
"296253052747206572294985417704943946671",
"152819930465334272050851702570251795814",
"207776637245864579636973418813845880535",
"247326417340638207882348321134312670377",
"172131508687723068962668990095793505307",
"128929424294162730225536411960257164893",
"42655862974744660471878333937242705176",
"156679441450492502625747075629338799934",
"293960004471387844996732516040301622448",
"165572860365956362724095114582633661314",
"6329721336339614758874166150893657249",
"3078102544062763670223238309588200736",
"231597389200083367665786542620613269064",
"123283576543467431374380698606046982788"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884",
"signature_type": "Line"
},
{
"id": "CVE-2023-52925-fe267cb9",
"digest": {
"function_hash": "200938743672450605778757137187470390188",
"length": 269.0
},
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nft_pipapo_activate",
"file": "net/netfilter/nft_set_pipapo.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4",
"signature_type": "Function"
}
]