In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo. This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f - This is expected to work, because its the same set after all and it was already loaded once. But with avx2, this fails: nft reports a clashing element. The reported clash is of following form: We successfully re-inserted a . b c . d Then we try to insert a . d avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next. Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*, i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched. No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback. Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug. Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate. The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.
During expiry of an entry in a pipapo set with a multi-field key (e.g., 'ipv4 . port'), the AVX2 matching function prematurely terminates processing of the last field without consuming the entire input data size. As a result, stale bits can remain in the result map, causing an incorrectly matched element to be returned that considers only the first field of the key. This results in false collision detection or the return of an inappropriate set element — the bug does not occur in the generic implementation (without AVX2) or when using the 'nft_pipapo_avx2_lookup_slow' fallback path.
An attacker or local user can cause netfilter rules to malfunction, potentially resulting in a breach of packet filtering policy integrity (rule bypass) and potential impact on availability or confidentiality of network traffic.
Apply patches available from the vendor according to references (commits: 07de44424bb7, 0abbc43f71d9, 3d53f9aafd46, d3c0037ffe12, fa4f1f52528c in stable Linux kernel branches). Until an update is applied, consider disabling AVX2 support in the nft_set_pipapo module or restricting the ability to load netfilter rules by unprivileged users.
Linux kernel with AVX2 support and the netfilter nft_set_pipapo_avx2 module; specific versions indicated in vendor references (patches available in stable Linux kernel branches).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LLinux Kernel
OSLinux7.05.7 – 6.6.136 (excl.)6.7 – 6.12.83 (excl.)6.13 – 6.18.24 (excl.)6.19 – 6.19.14 (excl.)
Related vulnerabilities
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP
RCE przez YAML deserialization w IBM Aspera Faspex
RCE w VMware Workspace ONE Access i Identity Manager poprzez server-side template injection
Command Injection w VMware Workspace One Access i Identity Manager