In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. The patch contains the following parts:
The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "336272051183642670216601771565322071467",
"length": 131.0
},
"target": {
"function": "ip_set_destroy_set_rcu",
"file": "net/netfilter/ipset/ip_set_core.c"
},
"id": "CVE-2024-39503-3dcb8d95",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "323886946463804347404969641351747435382",
"length": 412.0
},
"target": {
"function": "list_set_kadd",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-3e41d95a",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "323886946463804347404969641351747435382",
"length": 412.0
},
"target": {
"function": "list_set_kdel",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-44443366",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "261555193185283209664752093577155170291",
"length": 1722.0
},
"target": {
"function": "list_set_uadd",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-5615649f",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "55925729849471097235477324038237722765",
"length": 789.0
},
"target": {
"function": "list_set_udel",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-669bafc1",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "71744764456812184996073650053240911173",
"length": 182.0
},
"target": {
"function": "ip_set_destroy_set",
"file": "net/netfilter/ipset/ip_set_core.c"
},
"id": "CVE-2024-39503-7451e4e5",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51475905817612566820589484479606645646",
"22822161788244315079136426109565532465",
"171085780579952778040503341299810646142",
"93701779393109504473419040693743968286",
"51475905817612566820589484479606645646",
"22822161788244315079136426109565532465",
"171085780579952778040503341299810646142",
"93701779393109504473419040693743968286",
"276541801493388553137971888004955159499",
"339530131446804340108331617591584209468",
"69694623282552240013605496227167068289",
"171085780579952778040503341299810646142",
"93701779393109504473419040693743968286",
"72421824397377343433578230803794400019",
"249348563125773602464301589497952470043",
"235700376546366683994015484349935646325",
"270069923489719393000964597762239530269",
"63525556941852659354883573787660834332",
"83239602013962064130139658054844634391",
"73387194966348969081033652058695971271",
"52679289906913760892833483748799127539",
"320442894666120266923014174087720628845",
"239279111324677464902451124325274639507",
"191120920138911850924969545823592103800",
"50836548132704266382968887450538686609",
"291553656947118557995020209134019860169",
"93701779393109504473419040693743968286",
"294713197222140387739914872831113327060",
"162711344010540411036357004171204094044",
"52084511908656716084535870846734567257",
"62764529642987960866114323022649099977",
"93701779393109504473419040693743968286",
"36038042974136253840122835901396144951",
"25844718241569061794458944075432217836",
"234081511661133834376062381299388337589",
"315371339504394073881620388242999181095",
"63321146578548351110468372230461232883",
"227498528192135848359183666894030443814",
"160938029710753267348598926972746686559",
"150406595332394580389201449134003487507",
"101778880866894901663226191033816992879",
"73557239856834422897715156535923052967"
]
},
"target": {
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-7d1c846e",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "272380896264107289822489335074561290411",
"length": 319.0
},
"target": {
"function": "list_set_destroy",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-8130b195",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301758098735078998755871375233372618582",
"312353628758892581942546900352306012527",
"33673185960444036563235004532109092711",
"14216996794866331106807265509945765048",
"228148894281253433207250888778350057942",
"236042176536895991807941214806735483520",
"38605476388704653090127497857136691341",
"303551080246181611046283893652625919182",
"40456725722422328520408743655091445972",
"168408425152198956459463543356841257085",
"89934562833170797888638405493254101245",
"63318991052885582971846824784873095793",
"327103401851442813392932681142428487961",
"8429295023333511996802770936389174909",
"273016207379484232592972202210852643602",
"116414752867527150060154808065146641088",
"89278591971406323421468812053217725308",
"160073659112886186417933228910949565170",
"264851906902628511051443588321416183449",
"105294792791389052093273870532227074923",
"238597342773668941316578321681240380699",
"87871765858223400841323143266079215344",
"196897643427230816773756653022863212201",
"134760007197213117976297272886042300225",
"4362049263869771614885673610261768086",
"297138652251922853829265122691463737236",
"128690098276186626308346962814120847107",
"251700610453649022227249768351074174957",
"87495070150576550825890815227901136872",
"100733135803241035066842527959839299629",
"5591322852337245835166131830140714408",
"215031329789759165009627121449968950496",
"267701912704597028137605248033087611859",
"220773588464623184907922589503996482816",
"185769590088003767975159451083165854",
"301681435679540099664439254620550317229",
"272112218068016419625503244286466498802",
"198470945277004711297103707149360938424",
"69146809031140536626653561656873901866",
"249514680553134470359091911800794838437",
"193659927270353859768409218103425801453",
"207350469874245807121471808736396987029",
"115183382056767232999242730945012462331",
"174404880401884546238005080989284311379",
"246635233317881247673345737188263646697",
"146936276450848073765995011005863778877",
"304680124131105360265525965430015165782",
"41518039705950820995364861528375802445",
"138137412949209674383445411346019876776",
"239662693227853837410339950284978178696",
"139980633789951014010570713140078196712",
"20186532951561949545360007956067557620",
"21166587660303241991731271961294745084",
"299722622108419796111465430998340883639",
"113842418386404066439501206280373123008",
"169734970886391072395119906039886466020",
"190259734069307173200151323897739336955",
"228723198062921531309618342718784382600",
"33790361782563475312630655719590420156",
"113228144925589129787834755623400059248",
"8079064556626862127720462079232123522",
"339380563260467161852144148006828384356",
"90812281916094727310332703546151819946"
]
},
"target": {
"file": "net/netfilter/ipset/ip_set_core.c"
},
"id": "CVE-2024-39503-aeb897a7",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "118429304696982064306097100225413626376",
"length": 445.0
},
"target": {
"function": "ip_set_net_exit",
"file": "net/netfilter/ipset/ip_set_core.c"
},
"id": "CVE-2024-39503-b9eda89b",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b53c202b51a69e42ca57f5a183f7e008e19f83",
"digest": {
"function_hash": "187949019744885177933221581979129038236",
"length": 675.0
},
"target": {
"function": "list_set_utest",
"file": "net/netfilter/ipset/ip_set_list_set.c"
},
"id": "CVE-2024-39503-d3a3c05a",
"signature_version": "v1",
"signature_type": "Function"
}
]