Description Preview
In the Linux kernel, specifically in the netfilter nf_tables module, a vulnerability has been identified and resolved. The issue stems from the incorrect release of a mutex during a critical section between nft_gc_seq_begin() and nft_gc_seq_end(). This improper handling could allow an async garbage collection (GC) worker to collect expired objects and obtain the released commit lock within the same GC sequence. The function nf_tables_module_autoload() temporarily releases the mutex to load module dependencies and then replays the transaction. The recommended fix is to move the mutex release to the end of the abort phase after nft_gc_seq_end() is called.
Overview
The vulnerability in the Linux kernel's netfilter nf_tables module arises from the premature release of a mutex during a critical section, potentially allowing an async GC worker to collect expired objects and acquire the released commit lock within the same GC sequence.
Remediation
To address this vulnerability, it is recommended to move the release of the mutex in the nf_tables module to the end of the abort phase after nft_gc_seq_end() is called. By ensuring that the mutex is not released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), the risk of the async GC worker obtaining the released commit lock within the same GC sequence can be mitigated.
References
- Git commit for affected version 1: Link
- Git commit for affected version 2: Link
- Git commit for affected version 3: Link
- Git commit for affected version 4: Link
- Git commit for affected version 5: Link
- Git commit for affected version 6: Link
- Git commit for affected version 7: Link
- Debian LTS announcement: Link
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Health Care & Social AssistanceHealth Care & Social Assistance
- Public AdministrationPublic Administration
- Finance and InsuranceFinance and Insurance
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Educational ServicesEducational Services
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Other Services (except Public Administration)Other Services (except Public Administration)
- UtilitiesUtilities
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- InformationInformation
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Wholesale TradeWholesale Trade
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- MiningMining
