{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50000", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.387Z", "datePublished": "2025-06-18T11:00:59.959Z", "dateUpdated": "2026-08-05T08:57:08.735Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:08.735Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: fix stuck flows on cleanup due to pending work\n\nTo clear the flow table on flow table free, the following sequence\nnormally happens in order:\n\n 1) gc_step work is stopped to disable any further stats/del requests.\n 2) All flow table entries are set to teardown state.\n 3) Run gc_step which will queue HW del work for each flow table entry.\n 4) Waiting for the above del work to finish (flush).\n 5) Run gc_step again, deleting all entries from the flow table.\n 6) Flow table is freed.\n\nBut if a flow table entry already has pending HW stats or HW add work\nstep 3 will not queue HW del work (it will be skipped), step 4 will wait\nfor the pending add/stats to finish, and step 5 will queue HW del work\nwhich might execute after freeing of the flow table.\n\nTo fix the above, this patch flushes the pending work, then it sets the\nteardown flag to all flows in the flowtable and it forces a garbage\ncollector run to queue work to remove the flows from hardware, then it\nflushes this new pending work and (finally) it forces another garbage\ncollector run to remove the entry from the software flowtable.\n\nStack trace:\n[47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460\n[47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704\n[47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2\n[47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n[47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table]\n[47773.889727] Call Trace:\n[47773.890214] dump_stack+0xbb/0x107\n[47773.890818] print_address_description.constprop.0+0x18/0x140\n[47773.892990] kasan_report.cold+0x7c/0xd8\n[47773.894459] kasan_check_range+0x145/0x1a0\n[47773.895174] down_read+0x99/0x460\n[47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table]\n[47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table]\n[47773.913372] process_one_work+0x8ac/0x14e0\n[47773.921325]\n[47773.921325] Allocated by task 592159:\n[47773.922031] kasan_save_stack+0x1b/0x40\n[47773.922730] __kasan_kmalloc+0x7a/0x90\n[47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct]\n[47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct]\n[47773.925207] tcf_action_init_1+0x45b/0x700\n[47773.925987] tcf_action_init+0x453/0x6b0\n[47773.926692] tcf_exts_validate+0x3d0/0x600\n[47773.927419] fl_change+0x757/0x4a51 [cls_flower]\n[47773.928227] tc_new_tfilter+0x89a/0x2070\n[47773.936652]\n[47773.936652] Freed by task 543704:\n[47773.937303] kasan_save_stack+0x1b/0x40\n[47773.938039] kasan_set_track+0x1c/0x30\n[47773.938731] kasan_set_free_info+0x20/0x30\n[47773.939467] __kasan_slab_free+0xe7/0x120\n[47773.940194] slab_free_freelist_hook+0x86/0x190\n[47773.941038] kfree+0xce/0x3a0\n[47773.941644] tcf_ct_flow_table_cleanup_work\n\nOriginal patch description and stack trace by Paul Blakey." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered by freeing a netfilter/TC flowtable (tc flower + act_ct or nftables flowtable teardown) via netlink configuration, not by processing remote packets. Reachability is local syscall/netlink only.\nAC:L - An attacker who creates HW-offload-flagged flows (act_ct always sets NF_FLOWTABLE_HW_OFFLOAD) and then deletes the filter/flowtable can arrange pending add/stats work so the broken free sequence queues del work after the table is freed. Both sides of the lifecycle are attacker-controlled and reliably repeatable.\nPR:L - Creating and deleting these objects requires CAP_NET_ADMIN checked in the network namespace's user_ns (rtnetlink/nfnetlink). That capability is obtainable by an unprivileged user via user namespaces (unshare -Urn), so privileges are Low, not High.\nUI:N - The attacker issues the netlink configuration and traffic themselves; no separate victim action is required.\nS:U - This is a same-host kernel UAF leading to privilege escalation within the kernel's security authority, not a VM/IOMMU/sandbox boundary cross.\nC:H - KASAN confirms a use-after-free on the freed flowtable object (down_read on flow_block_lock after tcf_ct_flow_table_cleanup_work/kfree). UAF of a reclaimable slab object enables arbitrary read primitives.\nI:H - The same UAF write into the freed object (and dangling work holding flowtable/flow pointers) is exploitable for heap corruption and control-flow hijacking via reclaim/spray.\nA:H - The UAF causes kernel oops/panic (demonstrated KASAN write-after-free in the offload del workqueue), which is a complete availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/netfilter/nf_flow_table.h", "net/netfilter/nf_flow_table_core.c", "net/netfilter/nf_flow_table_offload.c" ], "versions": [ { "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a", "lessThan": "8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26", "status": "affected", "versionType": "git" }, { "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a", "lessThan": "89e135a36a9eb81412b5459df94a80995ce62eef", "status": "affected", "versionType": "git" }, { "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a", "lessThan": "9afb4b27349a499483ae0134282cefd0c90f480f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/netfilter/nf_flow_table.h", "net/netfilter/nf_flow_table_core.c", "net/netfilter/nf_flow_table_offload.c" ], "versions": [ { "version": "5.5", "status": "affected" }, { "version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.64", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.6", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26" }, { "url": "https://git.kernel.org/stable/c/89e135a36a9eb81412b5459df94a80995ce62eef" }, { "url": "https://git.kernel.org/stable/c/9afb4b27349a499483ae0134282cefd0c90f480f" } ], "title": "netfilter: flowtable: fix stuck flows on cleanup due to pending work", "x_generator": { "engine": "bippy-1.2.0" } } } }