In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.
According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d45f467096e931044f0ab7634499879d851a5c", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-099afea8", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-13cbfdd9", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@406b0241d0eb598a0b330ab20ae325537d8d8163", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-1976959f", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@552705a3650bbf46a22b1adedc1b04181490fc36", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-1e6e1455", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d75a589bb92af1abf3b779cfcd1977ca11b27033", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-28ef5ed6", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5224afbc30c3ca9ba23e752f0f138729b2c48dd8", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-2f26506c", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291cca35818bd52a407bc37ab45a15816039e363", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-4b2785a5", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@552705a3650bbf46a22b1adedc1b04181490fc36", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-749750e7", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-7c5f875d", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5224afbc30c3ca9ba23e752f0f138729b2c48dd8", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-9170d3c0", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d75a589bb92af1abf3b779cfcd1977ca11b27033", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "114158568995315930033771713951059659236", "length": 288.0 }, "id": "CVE-2024-26643-a6f8a1cd", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d45f467096e931044f0ab7634499879d851a5c", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-d4fd6ab4", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-dfc6dbe7", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291cca35818bd52a407bc37ab45a15816039e363", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-e4b8d5e0", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@406b0241d0eb598a0b330ab20ae325537d8d8163", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c" }, "digest": { "line_hashes": [ "216701269070329248940163749807763276511", "32600929826536836541516064039397631674", "127308397417742174520596735874044524420", "45828386588244406052682971749613059250" ], "threshold": 0.9 }, "id": "CVE-2024-26643-e72a502d", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf", "deprecated": false, "target": { "file": "net/netfilter/nf_tables_api.c", "function": "nf_tables_unbind_set" }, "digest": { "function_hash": "224374560223304276060183321890807974851", "length": 295.0 }, "id": "CVE-2024-26643-efdb1b21", "signature_type": "Function", "signature_version": "v1" } ]