CVE-2024-42269 - Linux Kernel Vulnerability Fixed in netfilter:iptables, Preventing Null Pointer Dereference in ip6table_nat_table_init()

A recently discovered vulnerability (CVE-2024-42269) in the Linux kernel has been resolved, specifically addressing an issue in the netfilter:iptables subsystem. This vulnerability was related to a potential null pointer dereference in the ip6table_nat_table_init() function. The null pointer dereference could lead to unexpected crashes or expose memory, affecting the stability and security of the system. In this post, we will discuss the details of the vulnerability and outline the steps taken to fix it.

Vulnerability Details

The ip6table_nat_table_init() function in question is responsible for initializing the IPv6 NAT table. This function was found to access an entry using net->gen->ptr[ip6table_nat_net_ops.id] without checking if the entry has been allocated beforehand.

Here's the code snippet that demonstrates the issue

static int __net_init ip6table_nat_table_init(struct net *net) {
    ...
    t = net->gen->ptr[ip6table_nat_net_ops.id];
    ...
} 

The code above shows that the function attempts to access an entry in the ptr array using the ip6table_nat_net_ops.id index. However, the allocation for the entry via register_pernet_subsys() must occur before the function can access it safely.

Any attempts to access an uninitialized entry can lead to null pointer dereference, which in turn can cause crashes or expose memory locations. The isc,'to fix this vulnerability, the order of function calls had to be adjusted to ensure that register_pernet_subsys() is called before xt_register_template().ResolutionThe vulnerability in the ip6table_nat_table_init() function has been fixed by ensuring that the entry is allocated before being accessed. This was achieved by calling register_pernet_subsys() before xt_register_template().Here's the code snippet with the patched order of function callsOriginal References

1. [Linux kernel source code repository (see the net/netfilter/ip6table_nat.c file)
2. Official CVE entry for CVE-2024-42269

Conclusion

The Linux kernel vulnerability CVE-2024-42269 has been resolved by fixing a potential null pointer dereference issue in the netfilter:iptables subsystem. By adjusting the order of function calls in the ip6table_nat_table_init() function, the risk of null pointer dereference and potential crashes or memory exposure has been mitigated, ensuring safer and more reliable operation for Linux kernel-based systems.

Timeline

Published on: 08/17/2024 09:15:08 UTC
Last modified on: 08/19/2024 20:53:51 UTC