In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selftests fail: run-tests.sh testcases/sets/0044intervaloverlap0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044intervaloverlap0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nftpipapoactivate:
It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nftpipaporemove fetches elem->priv, then does a relookup, remove this.
I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback.
In first two cases expired elements must be skipped.
For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error.
{ "vanir_signatures": [ { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_get" }, "id": "CVE-2023-52925-015e7a24", "digest": { "length": 348.0, "function_hash": "325761354113893679421838361900699483012" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_remove" }, "id": "CVE-2023-52925-0617e6c2", "digest": { "length": 1059.0, "function_hash": "40768845345004800933822274960623587644" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_activate" }, "id": "CVE-2023-52925-13ae9ce6", "digest": { "length": 269.0, "function_hash": "200938743672450605778757137187470390188" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "pipapo_get" }, "id": "CVE-2023-52925-30cddf20", "digest": { "length": 1256.0, "function_hash": "166365330826119468837678344004715500192" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_activate" }, "id": "CVE-2023-52925-3bd7cf4a", "digest": { "length": 269.0, "function_hash": "200938743672450605778757137187470390188" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_remove" }, "id": "CVE-2023-52925-50c0ecfc", "digest": { "length": 1059.0, "function_hash": "40768845345004800933822274960623587644" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "pipapo_get" }, "id": "CVE-2023-52925-688f3eff", "digest": { "length": 1256.0, "function_hash": "166365330826119468837678344004715500192" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "pipapo_get" }, "id": "CVE-2023-52925-720f1402", "digest": { "length": 1256.0, "function_hash": "166365330826119468837678344004715500192" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "pipapo_get" }, "id": "CVE-2023-52925-8a005c32", "digest": { "length": 1256.0, "function_hash": "166365330826119468837678344004715500192" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_activate" }, "id": "CVE-2023-52925-8c27d7f7", "digest": { "length": 269.0, "function_hash": "200938743672450605778757137187470390188" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_get" }, "id": "CVE-2023-52925-9194401f", "digest": { "length": 348.0, "function_hash": "325761354113893679421838361900699483012" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_activate" }, "id": "CVE-2023-52925-9d4c4421", "digest": { "length": 269.0, "function_hash": "200938743672450605778757137187470390188" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "net/netfilter/nft_set_pipapo.c" }, "id": "CVE-2023-52925-9fbe4706", "digest": { "threshold": 0.9, "line_hashes": [ "18450126200245501346610813786440128730", "143305370865365886841666885255216717227", "250679631463517267708042436348395558378", "250553916107176745983083347008827387659", "58005933470820188500748819879498336996", "38748976874673614083111366367963363909", "69306701867235603578437752540162231854", "27049818398871776726792179890787271100", "239480119482490245670011841179229516237", "204445958656384142548175792818889367026", "2293840841847362166573503950226599051", "241486783787671794707878224107498792243", "234922986411736396990808943458183270145", "133447047865747649337348351147452777963", "296253052747206572294985417704943946671", "152819930465334272050851702570251795814", "207776637245864579636973418813845880535", "247326417340638207882348321134312670377", "172131508687723068962668990095793505307", "128929424294162730225536411960257164893", "42655862974744660471878333937242705176", "156679441450492502625747075629338799934", "293960004471387844996732516040301622448", "165572860365956362724095114582633661314", "6329721336339614758874166150893657249", "3078102544062763670223238309588200736", "231597389200083367665786542620613269064", "123283576543467431374380698606046982788" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_remove" }, "id": "CVE-2023-52925-a675199c", "digest": { "length": 1059.0, "function_hash": "40768845345004800933822274960623587644" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "net/netfilter/nft_set_pipapo.c" }, "id": "CVE-2023-52925-ae148f77", "digest": { "threshold": 0.9, "line_hashes": [ "18450126200245501346610813786440128730", "143305370865365886841666885255216717227", "250679631463517267708042436348395558378", "250553916107176745983083347008827387659", "58005933470820188500748819879498336996", "38748976874673614083111366367963363909", "69306701867235603578437752540162231854", "27049818398871776726792179890787271100", "239480119482490245670011841179229516237", "204445958656384142548175792818889367026", "2293840841847362166573503950226599051", "241486783787671794707878224107498792243", "234922986411736396990808943458183270145", "133447047865747649337348351147452777963", "296253052747206572294985417704943946671", "152819930465334272050851702570251795814", "207776637245864579636973418813845880535", "247326417340638207882348321134312670377", "172131508687723068962668990095793505307", "128929424294162730225536411960257164893", "42655862974744660471878333937242705176", "156679441450492502625747075629338799934", "293960004471387844996732516040301622448", "165572860365956362724095114582633661314", "6329721336339614758874166150893657249", "3078102544062763670223238309588200736", "231597389200083367665786542620613269064", "123283576543467431374380698606046982788" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@891ca5dfe3b718b441fc786014a7ba8f517da188", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_get" }, "id": "CVE-2023-52925-b128cbfb", "digest": { "length": 348.0, "function_hash": "325761354113893679421838361900699483012" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_remove" }, "id": "CVE-2023-52925-b840018d", "digest": { "length": 1059.0, "function_hash": "40768845345004800933822274960623587644" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ee68c437c562170265194a99698c805a686bb3", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "net/netfilter/nft_set_pipapo.c" }, "id": "CVE-2023-52925-c393c732", "digest": { "threshold": 0.9, "line_hashes": [ "18450126200245501346610813786440128730", "143305370865365886841666885255216717227", "250679631463517267708042436348395558378", "250553916107176745983083347008827387659", "58005933470820188500748819879498336996", "38748976874673614083111366367963363909", "69306701867235603578437752540162231854", "27049818398871776726792179890787271100", "239480119482490245670011841179229516237", "204445958656384142548175792818889367026", "2293840841847362166573503950226599051", "241486783787671794707878224107498792243", "234922986411736396990808943458183270145", "133447047865747649337348351147452777963", "296253052747206572294985417704943946671", "152819930465334272050851702570251795814", "207776637245864579636973418813845880535", "247326417340638207882348321134312670377", "172131508687723068962668990095793505307", "128929424294162730225536411960257164893", "42655862974744660471878333937242705176", "156679441450492502625747075629338799934", "293960004471387844996732516040301622448", "165572860365956362724095114582633661314", "6329721336339614758874166150893657249", "3078102544062763670223238309588200736", "231597389200083367665786542620613269064", "123283576543467431374380698606046982788" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_get" }, "id": "CVE-2023-52925-c51e7d28", "digest": { "length": 348.0, "function_hash": "325761354113893679421838361900699483012" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "pipapo_get" }, "id": "CVE-2023-52925-c633b90e", "digest": { "length": 1256.0, "function_hash": "166365330826119468837678344004715500192" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "net/netfilter/nft_set_pipapo.c" }, "id": "CVE-2023-52925-c72173da", "digest": { "threshold": 0.9, "line_hashes": [ "18450126200245501346610813786440128730", "143305370865365886841666885255216717227", "250679631463517267708042436348395558378", "250553916107176745983083347008827387659", "58005933470820188500748819879498336996", "38748976874673614083111366367963363909", "69306701867235603578437752540162231854", "27049818398871776726792179890787271100", "239480119482490245670011841179229516237", "204445958656384142548175792818889367026", "2293840841847362166573503950226599051", "241486783787671794707878224107498792243", "234922986411736396990808943458183270145", "133447047865747649337348351147452777963", "296253052747206572294985417704943946671", "152819930465334272050851702570251795814", "207776637245864579636973418813845880535", "247326417340638207882348321134312670377", "172131508687723068962668990095793505307", "128929424294162730225536411960257164893", "42655862974744660471878333937242705176", "156679441450492502625747075629338799934", "293960004471387844996732516040301622448", "165572860365956362724095114582633661314", "6329721336339614758874166150893657249", "3078102544062763670223238309588200736", "231597389200083367665786542620613269064", "123283576543467431374380698606046982788" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_get" }, "id": "CVE-2023-52925-d61f4691", "digest": { "length": 348.0, "function_hash": "325761354113893679421838361900699483012" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156369a702c33ad5434a19c3a689bfb836d4e0b8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_remove" }, "id": "CVE-2023-52925-e67bf40a", "digest": { "length": 1059.0, "function_hash": "40768845345004800933822274960623587644" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "net/netfilter/nft_set_pipapo.c" }, "id": "CVE-2023-52925-ef550f47", "digest": { "threshold": 0.9, "line_hashes": [ "18450126200245501346610813786440128730", "143305370865365886841666885255216717227", "250679631463517267708042436348395558378", "250553916107176745983083347008827387659", "58005933470820188500748819879498336996", "38748976874673614083111366367963363909", "69306701867235603578437752540162231854", "27049818398871776726792179890787271100", "239480119482490245670011841179229516237", "204445958656384142548175792818889367026", "2293840841847362166573503950226599051", "241486783787671794707878224107498792243", "234922986411736396990808943458183270145", "133447047865747649337348351147452777963", "296253052747206572294985417704943946671", "152819930465334272050851702570251795814", "207776637245864579636973418813845880535", "247326417340638207882348321134312670377", "172131508687723068962668990095793505307", "128929424294162730225536411960257164893", "42655862974744660471878333937242705176", "156679441450492502625747075629338799934", "293960004471387844996732516040301622448", "165572860365956362724095114582633661314", "6329721336339614758874166150893657249", "3078102544062763670223238309588200736", "231597389200083367665786542620613269064", "123283576543467431374380698606046982788" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7845914f45f066497ac75b30c50dbc735e84e884", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "net/netfilter/nft_set_pipapo.c", "function": "nft_pipapo_activate" }, "id": "CVE-2023-52925-fe267cb9", "digest": { "length": 269.0, "function_hash": "200938743672450605778757137187470390188" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af78b0489e8898a8c9449ffc0fdd2e181916f0d4", "signature_version": "v1" } ] }