Bug 2265184 (CVE-2023-52433)

Summary:	CVE-2023-52433 kernel: nf_tables: nft_set_rbtree skip sync GC for new elements in this transaction
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.6-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nft_set_rbtree, where new elements in this transaction might expire before the transaction ends. Skip sync GC for such elements, otherwise a commit path might walk over an already released object. Once the transaction is finished, async GC will collect expired elements.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-02-28 17:29:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2265187
Bug Blocks:	2265182

Description Patrick Del Bello 2024-02-20 20:19:40 UTC

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk
over an already released object. Once transaction is finished, async GC will collect such expired element.

https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a

Comment 1 Patrick Del Bello 2024-02-20 20:20:11 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2265187]

Comment 4 Justin M. Forbes 2024-02-21 22:56:56 UTC

This was fixed for Fedora with the 6.7.5 stable kernel updates.

Comment 5 Justin M. Forbes 2024-02-21 23:02:14 UTC

I apologize, this one is actually fixed with the 6.5.4 stable kernel updates, I had it confused with another.

Comment 10 Alex 2024-06-09 15:06:02 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2023-52433 is: CHECK	Maybe valid. Check manually. with impact MODERATE (that is approximation based on flags REMOTE SIMPLEFIX NETFILTER  ; these flags parsed automatically based on patche data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing CVE). Highs always checked manually (I check it myself and then we check it again in Remediation team). In rare cases some of the Moderates could be increased to High later.