CVE-2024-42109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42109", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.176Z", "datePublished": "2024-07-30T07:46:04.194Z", "dateUpdated": "2026-08-05T11:35:41.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:41.134Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally flush pending work before notifier\n\nsyzbot reports:\n\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\n\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\n\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\n\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered only through `sendmsg()`/`close()` on a local `AF_NETLINK`/`NETLINK_NETFILTER` socket handled by `nfnetlink_rcv_msg()`; the notifier `nft_rcv_nl_event()` fires on local socket release. There is no remote or adjacent-network route into nf_tables transaction teardown.\nAC:L - The attacker drives both halves of the race \u2014 issuing the nftables commit that queues transactions to `nf_tables_destroy_list` and schedule `trans_destroy_work`, then closing the owning netlink socket \u2014 and the worker's `list_splice_init()` plus `synchronize_rcu()` leaves a millisecond-wide window in which `list_empty()` is falsely true. The sequence is deterministic to set up and infinitely retryable, and syzbot produced a working reproducer.\nPR:L - The only check is `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is `ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)` \u2014 satisfied by any unprivileged user via `unshare -Urn` on distros with unprivileged user namespaces enabled. No real root in the init namespace is required.\nUI:N - The attacker performs the entire sequence \u2014 table creation with `NFT_TABLE_F_OWNER`, the delete commit, and the socket close \u2014 from its own process with no victim involvement.\nS:U - The freed object and all its dereferences live in kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a confirmed slab use-after-free read of the `nft_table` object (`kmalloc-cg-*`, syzbot: \"Read of size 2\"); an attacker can reoccupy the freed slot by heap spraying and have the worker read attacker-chosen data, including the `ctx->table->name` pointer consumed by `nft_compat`, yielding an information-disclosure primitive.\nI:H - The dangling `trans->ctx.table` is fed to `nft_set_destroy()`, `nf_tables_chain_destroy()`, `nft_obj_destroy()` and every expression `->destroy()` callback, so a reclaimed slot lets the attacker steer subsequent frees, refcount decrements, and function-pointer-driven teardown \u2014 a classic UAF path to controlled writes and control-flow hijack.\nA:H - Even unexploited, the use-after-free corrupts kernel state inside a workqueue context and reliably produces an oops/panic, as demonstrated by the syzbot KASAN splat in `nf_tables_trans_destroy_work`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "f22954f8c58fd5f5489f5980796914e306757e77", "lessThan": "3325628cb36b7f216c5716e7b5124d9dc81199e4", "status": "affected", "versionType": "git"}, {"version": "41841b585e53babdfb0fa6fdfa54f6d7c28c1206", "lessThan": "4c06c13317b9a08decedcd7aaf706691e336277c", "status": "affected", "versionType": "git"}, {"version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "55a40406aac555defe9bdd0adec9508116ce7cb1", "status": "affected", "versionType": "git"}, {"version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "09e650c3a3a7d804430260510534ccbf71c75b2e", "status": "affected", "versionType": "git"}, {"version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "9f6958ba2e902f9820c594869bd710ba74b7c4c0", "status": "affected", "versionType": "git"}, {"version": "4167aa477abcf62b0dfda51f3513280fa73cd588", "status": "affected", "versionType": "git"}, {"version": "5.15.129", "lessThan": "5.15.163", "status": "affected", "versionType": "semver"}, {"version": "6.1.50", "lessThan": "6.1.98", "status": "affected", "versionType": "semver"}, {"version": "6.4.13", "lessThan": "6.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.129", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.50", "versionEndExcluding": "6.1.98"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.9.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"}, {"url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"}, {"url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"}, {"url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"}, {"url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"}], "title": "netfilter: nf_tables: unconditionally flush pending work before notifier", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:01:44.106Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:17:36.218121Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:06.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:01:44.106Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:17:36.218121Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.593Z"}}], "cna": {"title": "netfilter: nf_tables: unconditionally flush pending work before notifier", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f22954f8c58fd5f5489f5980796914e306757e77", "lessThan": "3325628cb36b7f216c5716e7b5124d9dc81199e4", "versionType": "git"}, {"status": "affected", "version": "41841b585e53babdfb0fa6fdfa54f6d7c28c1206", "lessThan": "4c06c13317b9a08decedcd7aaf706691e336277c", "versionType": "git"}, {"status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "55a40406aac555defe9bdd0adec9508116ce7cb1", "versionType": "git"}, {"status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "09e650c3a3a7d804430260510534ccbf71c75b2e", "versionType": "git"}, {"status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "lessThan": "9f6958ba2e902f9820c594869bd710ba74b7c4c0", "versionType": "git"}, {"status": "affected", "version": "4167aa477abcf62b0dfda51f3513280fa73cd588", "versionType": "git"}, {"status": "affected", "version": "5.15.129", "lessThan": "5.15.163", "versionType": "semver"}, {"status": "affected", "version": "6.1.50", "lessThan": "6.1.98", "versionType": "semver"}, {"status": "affected", "version": "6.4.13", "lessThan": "6.5", "versionType": "semver"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.98", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.39", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.9", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"}, {"url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"}, {"url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"}, {"url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"}, {"url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally flush pending work before notifier\n\nsyzbot reports:\n\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\n\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\n\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\n\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.15.129"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.98", "versionStartIncluding": "6.1.50"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.39", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.9", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.4.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:52:06.989Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42109", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:52:06.989Z", "dateReserved": "2024-07-29T15:50:41.176Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-30T07:46:04.194Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3325628cb36b7f216c5716e7b5124d9dc81199e4", "status": "affected", "version": "f22954f8c58fd5f5489f5980796914e306757e77", "versionType": "git"}, {"lessThan": "4c06c13317b9a08decedcd7aaf706691e336277c", "status": "affected", "version": "41841b585e53babdfb0fa6fdfa54f6d7c28c1206", "versionType": "git"}, {"lessThan": "55a40406aac555defe9bdd0adec9508116ce7cb1", "status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "versionType": "git"}, {"lessThan": "09e650c3a3a7d804430260510534ccbf71c75b2e", "status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "versionType": "git"}, {"lessThan": "9f6958ba2e902f9820c594869bd710ba74b7c4c0", "status": "affected", "version": "2c9f0293280e258606e54ed2b96fa71498432eae", "versionType": "git"}, {"status": "affected", "version": "4167aa477abcf62b0dfda51f3513280fa73cd588", "versionType": "git"}, {"lessThan": "5.15.163", "status": "affected", "version": "5.15.129", "versionType": "semver"}, {"lessThan": "6.1.98", "status": "affected", "version": "6.1.50", "versionType": "semver"}, {"lessThan": "6.5", "status": "affected", "version": "6.4.13", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.98", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.39", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FD25434-47C3-45B8-B46A-6352379CD2F9", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.15.129", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "24E84470-CB41-4B10-ACC2-6579459F3A48", "versionEndExcluding": "6.1.98", "versionStartIncluding": "6.1.50", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E079242F-1B25-40DA-BCE2-2A7965C9168E", "versionEndExcluding": "6.6.39", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADCC1407-0CB3-4C8F-B4C5-07F682CD7085", "versionEndExcluding": "6.9.9", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally flush pending work before notifier\n\nsyzbot reports:\n\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\n\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\n\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\n\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: vaciar incondicionalmente el trabajo pendiente antes de que el notificador syzbot informe: KASAN: slab-uaf en nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf en nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Lectura de tama\u00f1o 2 en la direcci\u00f3n ffff88802b0051c4 por tarea kworker/1:1/45 [..] ue : eventos nf_tables_trans_destroy_work Seguimiento de llamadas: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [en l\u00ednea] nft_commit_release net/netfilter/nf_tables_api.c:9530 [en l\u00ednea] nf_tables_trans_destroy_work+0x152b/0x1750 s_api.c:9597 El problema es que el notificador realiza un vaciado condicional, pero es posible que las transacciones que procesa el trabajador a\u00fan hagan referencia a la tabla que se va a eliminar, por lo que debemos realizar un vaciado incondicional. Podr\u00edamos hacer que flux_work dependa de si encontramos una tabla para eliminar en nf-next para evitar el vaciado en la mayor\u00eda de los casos. AFAICS, este problema solo se expone en nf-next, con la confirmaci\u00f3n e169285f8c56 (\"netfilter: nf_tables: no almacenar nft_ctx en objetos de transacci\u00f3n\"), con esta confirmaci\u00f3n aplicada hay una b\u00fasqueda incondicional de tabla->familia que es lo que desencadena lo anterior salpicar."}], "id": "CVE-2024-42109", "lastModified": "2026-08-04T11:19:34.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:17:36.218121Z", "version": "2.0.3"}}]}, "published": "2024-07-30T08:15:03.407", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: nf_tables: unconditionally flush pending work before notifier", "id": "2301472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301472"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_tables: unconditionally flush pending work before notifier\nsyzbot reports:\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\nnft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\nnft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\nnf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-42109", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42109\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42109\nhttps://lore.kernel.org/linux-cve-announce/2024073021-CVE-2024-42109-2531@gregkh/T"], "threat_severity": "Low"}

{}