CVE-2021-47394

What it actually does

Use-after-free in nf_tables table lookup during concurrent lockless GET operations after table deletion under commit_mutex, allowing read access to freed objects via nla_strcmp and nft_table_lookup.

Why it matters to the business

Attackers with local access can trigger kernel memory corruption, leading to system crashes, denial of service, or potential privilege escalation on affected Linux systems.

How an attack unfolds

An attacker sends crafted netlink messages to create and delete nftables tables while racing with concurrent GET operations; the unlink-before-delete fix prevents parallel readers from accessing freed table objects post-RCU grace period.

How to fix it

Update to a Linux kernel version containing the commit that unlinks the table before deletion and stores objects in on-stack scratch space; apply vendor-supplied kernel updates promptly.

How to confirm the fix worked

Confirm kernel version includes the nf_tables unlink fix; test by attempting concurrent table create/delete and get operations under load to verify absence of KASAN reports.

Typical attack path

1. Open netlink socket to nfnetlink
2. Issue NFT_MSG_NEWTABLE to create table
3. Trigger concurrent NFT_MSG_GETSET or similar read operations
4. Issue NFT_MSG_DELTABLE to delete table
5. Continue read operations to access freed memory via nft_table_lookup

How to detect it

Review kernel logs for KASAN use-after-free reports involving nft_table_lookup, nla_strcmp, or nfnetlink_rcv_msg; inspect audit logs for unusual nftables netlink activity patterns around table create/delete.

What your security team should do

• Prioritize kernel updates on all systems exposing netfilter/nftables to untrusted local users
• Monitor for upstream kernel releases addressing this UAF
• Restrict unprivileged access to nftables netlink interfaces via capabilities or seccomp where feasible