Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: make sure gc is properly stopped
Sashiko noticed that when destroying a set,
cancel_delayed_work_sync() was called while gc
calls queue_delayed_work() unconditionally which
can lead not to properly shutting down the gc.
A flaw was found in the Linux kernel's netfilter ipset component. When destroying a set, the garbage collection (gc) mechanism may not be properly stopped due to an unconditional call to queue_delayed_work() while cancel_delayed_work_sync() is called. This improper shutdown can lead to resource exhaustion, potentially resulting in a Denial of Service (DoS) condition.
Отчет
A flaw was found in the Linux kernel's netfilter ipset subsystem, rated by Red Hat Product Security as having Moderate impact. When an ipset that uses timeout-based garbage collection is destroyed, the garbage collection (gc) delayed work is not reliably stopped: cancel_delayed_work_sync() is called while the gc path can still unconditionally call queue_delayed_work() and re-queue itself, so a later gc run may operate on a set that has already been freed. A local attacker with the privileges required to manage ipsets (for example CAP_NET_ADMIN, which may be delegated to a container root or a network management service rather than full host root) could trigger this race by destroying a set, causing an RCU stall, kernel panic, or other system instability, resulting in a denial of service. Red Hat has assessed this flaw as having availability-only impact (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this is lower than the upstream CVEORG score of 7.8 because the upstream score assumes high confidentiality and integrity impact, which Red Hat's analysis does not support for this race-condition-driven gc shutdown issue. The kernel and kernel-rt packages in Red Hat Enterprise Linux 8 (rhel-8.10.z), Red Hat Enterprise Linux 9 (rhel-9.2.0.z through rhel-9.9), and Red Hat Enterprise Linux 10 (rhel-10.0.z through rhel-10.3) are affected, and the fix is currently deferred to a future update for these streams. Exploitation requires privileged local access and a narrow race window during set destruction, and the consequence is limited to local denial of service, so the residual risk of deferring the fix is considered low. Red Hat Enterprise Linux 6 ELS is out of support scope for this flaw. Red Hat Enterprise Linux 7 ELS, the rhel-8.4.0.z, rhel-8.6.0.z, and rhel-8.8.0.z update streams, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those builds.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel_delayed_work_sync() was called while gc calls queue_delayed_work() unconditionally which can lead not to properly shutting down the gc.
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel_delayed_work_sync() was called while gc calls queue_delayed_work() unconditionally which can lead not to properly shutting down the gc.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel_delayed_work_sync() was called while gc calls queue_delayed_work() unconditionally which can lead not to properly shutting down the gc.
5.5 Medium
CVSS3