Re: CVE-2024-39503: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

[Sasha Levin <sashal@kernel.org>]

On Wed, Aug 07, 2024 at 06:42:14AM +0000, Siddh Raman Pant wrote:
>On Fri, 12 Jul 2024 14:21:09 +0200, Greg Kroah-Hartman wrote:
>> In the Linux kernel, the following vulnerability has been resolved:
>>
>> netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
>>
>> Lion Ackermann reported that there is a race condition between namespace cleanup
>> in ipset and the garbage collection of the list:set type. The namespace
>> cleanup can destroy the list:set type of sets while the gc of the set type is
>> waiting to run in rcu cleanup. The latter uses data from the destroyed set which
>> thus leads use after free. The patch contains the following parts:
>>
>> - When destroying all sets, first remove the garbage collectors, then wait
>>   if needed and then destroy the sets.
>> - Fix the badly ordered "wait then remove gc" for the destroy a single set
>>   case.
>> - Fix the missing rcu locking in the list:set type in the userspace test
>>   case.
>> - Use proper RCU list handlings in the list:set type.
>>
>> The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
>
>This commit does not exist in stable kernels. Please backport it.
>
>	netfilter: ipset: Add list flush to cancel_gc
>	
>	Flushing list in cancel_gc drops references to other lists right away,
>	without waiting for RCU to destroy list. Fixes race when referenced
>	ipsets can't be destroyed while referring list is scheduled for destroy.
>
>Since this is missing, the CVE fix potentially introduced new races as
>it makes use of RCU.

Indeed, looks like it was missing on older trees. I'll queue it up.

Thanks!

-- 
Thanks,
Sasha