CVE-2022-50213

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not allow SET_ID to refer to another table

When doing lookups for sets on the same batch by using its ID, a set from a different table can be used.

Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free.

When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table.

This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation is confined to local authenticated users possessing network administration capabilities or access to unprivileged user namespaces. Under default configurations where unprivileged user namespaces are restricted, unauthenticated remote attackers cannot trigger this flaw. Although a local attacker with appropriate privileges could trigger memory corruption leading to a system crash or potential privilege escalation, the prerequisite of local administrative capabilities bounds the overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.