title: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
description: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
While the rhashtable set gc runs asynchronously, a race allows it to
collect elements from anonymous sets with timeouts while it is being
released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x
with a pipapo set with low timeouts which is not possible upstream since
7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc
in this case.
According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
transaction abort"), Florian plans to accelerate abort path by releasing
objects via workqueue, therefore, this sets on the dead flag for abort
path too.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: ea3eb9f2192e, lessThan: 406b0241d0eb, status: affected, versionType: git
version: 5f68718b34a5, lessThan: b2d6f9a5b1cf, status: affected, versionType: git
version: 5f68718b34a5, lessThan: 5224afbc30c3, status: affected, versionType: git
version: 5f68718b34a5, lessThan: 552705a3650b, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.5, status: affected
version: 0, lessThan: 6.5, status: unaffected, versionType: custom
version: 6.1.84, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.24, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.12, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
