CVE-2024-42109

A vulnerability was found in the Linux kernel in the nft_rcv_nl_event() function where a conditional flush on the pending nf_tables objects to be destroyed could lead to a situation where the table-to-be-removed is still referenced by transactions being processed by the worker, causing use-after-free errors because a deleted object is being referenced. This vulnerability could lead to system instability or crashes.

A low impact use-after-free flaw was found in the Linux kernel netfilter/nf_tables subsystem. When a network namespace is removed, the nft_rcv_nl_event() notifier performs only a conditional flush of pending nf_tables destroy work, so a table that is being removed can still be referenced by transactions being processed by the destroy worker, resulting in a use-after-free. A local user with the privileges required to manipulate nf_tables state (CAP_NET_ADMIN in the affected network namespace) could use this flaw to crash the system, causing a denial of service. Red Hat's assessment found no impact on confidentiality or integrity, which is why the Red Hat severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Low impact) is lower than the CVE.org score of 7.8 that assumes high confidentiality and integrity impacts.

In Red Hat Enterprise Linux 9 the kernel and kernel-rt components are marked as affected with the fix deferred, as the flaw is rated low impact; the residual risk is a local denial of service by a privileged user. Red Hat Enterprise Linux 6 and 8 releases and the hosted OpenShift offerings are not affected, since per the upstream analysis the triggering code path was only introduced in nf_tables development code that those releases do not contain, and Red Hat Enterprise Linux 7 is out of support scope. The Fedora kernel was affected and received the fix through the normal Fedora update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.