CVE-2022-49561
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the netfilter conntrack module has been fixed, where after insertion of a conntrack entry, a clash can occur, leading to freeing skb->_nfct and setting it to an already-confirmed entry. This was not found before because the conntrack entry and extension space were freed after an RCU grace period, and the race requires events enabled to trigger.
Risk Assessment
The vulnerability could lead to use-after-free, potentially causing system crashes or privilege escalation. An attacker could exploit this by sending specially crafted network packets.
Recommendation
Update the Linux kernel to a version with the fix. Also monitor network traffic for suspicious conntrack-related activity.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.