CVE-2024-50257

In the Linux kernel, the following vulnerability has been resolved:

netfilter: Fix use-after-free in get_info()

ip6table_nat module unload has refcnt warning for UAF. call trace is:

WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80

Modules linked in: ip6table_nat(-)

CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),

BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

RIP: 0010:module_put+0x6f/0x80

Call Trace:

<TASK>

get_info+0x128/0x180

do_ip6t_get_ctl+0x6a/0x430

nf_getsockopt+0x46/0x80

ipv6_getsockopt+0xb9/0x100

rawv6_getsockopt+0x42/0x190

do_sock_getsockopt+0xaa/0x180

__sys_getsockopt+0x70/0xc0

__x64_sys_getsockopt+0x20/0x30

do_syscall_64+0xa2/0x1a0

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Concurrent execution of module unload and get_info() trigered the warning.

The root cause is as follows:

cpu0 cpu1

module_exit

//mod->state = MODULE_STATE_GOING

ip6table_nat_exit

xt_unregister_template

kfree(t)

//removed from templ_list

getinfo()

t = xt_find_table_lock

list_for_each_entry(tmpl, &xt_templates[af]...)

if (strcmp(tmpl->name, name))

continue; //table not found

try_module_get

list_for_each_entry(t, &xt_net->tables[af]...)

return t; //not get refcnt

module_put(t->me) //uaf

unregister_pernet_subsys

//remove table from xt_net list

While xt_table module was going away and has been removed from

xt_templates list, we couldnt get refcnt of xt_table->me. Check

module in xt_net->tables list re-traversal to fix it.