CVE-2021-47312

What it actually does

Null pointer dereference occurs in nft_flow_rule_destroy during error handling when chain->flags lacks NFT_CHAIN_HW_OFFLOAD, leaving flow uninitialized as NULL after skipping nft_flow_rule_create.

Why it matters to the business

Potential system crashes or denial of service affecting network packet filtering operations on Linux-based systems, increasing operational risk for environments relying on nftables hardware offload paths.

How an attack unfolds

An attacker configures an nftables chain without hardware offload flags and triggers an error condition during rule creation, causing the kernel to follow the err_destroy_flow_rule path and dereference the null flow pointer.

How to fix it

Apply the kernel fix ensuring nft_flow_rule_destroy is only invoked when flow is non-null; for affected glpi-project/glpi instances upgrade to commit 0c860f018f5bd0f08b87d217a376304e62a5ba58 or later.

How to confirm the fix worked

Review source for conditional guard before nft_flow_rule_destroy call; test nftables chain creation without HW offload under error injection scenarios; confirm no Coverity null dereference warnings remain.

Typical attack path

1. Identify or create an nftables chain with NFT_CHAIN_HW_OFFLOAD flag unset
2. Trigger nft_flow_rule_create failure or bypass to reach error label
3. Execute nft_flow_rule_destroy on the resulting NULL flow pointer
4. Cause kernel panic or crash

How to detect it

Inspect kernel logs for null pointer dereference oops in nf_tables or nft_flow_rule paths; correlate with nftables chain configuration events lacking hardware offload.

What your security team should do

• Prioritize patching Linux kernel netfilter components on all affected hosts
• Monitor for nftables configuration changes involving chains
• Validate upgrade to the specified glpi commit if using that distribution path
• Review nftables rulesets for hardware offload dependencies