Listen to this Post
This vulnerability exists in the netfilter ipset subsystem of the Linux kernel, specifically affecting hash-type sets that use timeouts. A region locking mechanism was introduced to improve performance, utilizing three key macros: ahash_bucket_start(), ahash_bucket_end(), and ahash_region(). The `ahash_region()` macro was incorrectly implemented, failing to return the proper region lock for a given hash bucket. This flaw creates a race condition window between two kernel operations: the garbage collector, which removes expired entries from sets with timeouts, and the simultaneous addition of new elements to the same set. When exploited, this race can lead to a use-after-free scenario or data corruption, ultimately causing a kernel panic and a denial of service by crashing the system.
Platform: Linux Kernel
Version: v5.6-rc4+
Vulnerability: Race Condition
Severity: 5.5 MEDIUM
date: 2025-05-29
Prediction: Patches released 2025-06/2025-08
What Undercode Say:
Check for ipset hash types with timeouts ipset list -t | grep -A2 "Type: hash" | grep -E "Header|timeout" Monitor kernel logs for related errors dmesg | grep -i "ipset|netfilter|general protection fault" List loaded kernel modules for netfilter lsmod | grep -E "ip_set|xt_set|nfnetlink"
How Exploit:
An attacker with local access and low privileges (CAP_NET_ADMIN) can trigger the race by rapidly adding elements to a vulnerable hash-type ipset configured with timeouts. The exploit involves creating a set and executing concurrent threads—one adding new members and another forcing garbage collection—to collide within the incorrect region lock window. Successful collision corrupts kernel memory, leading to a system crash and denial of service.
Protection from this CVE
Update kernel to patched version.
Restrict CAP_NET_ADMIN capabilities.
Avoid ipset timeout use temporarily.
Impact
Availability: System crash.
Local privilege required.
No confidentiality impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
