CVE-2021-29650: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-29650 was discovered in the Linux kernel before version 5.11.11. The vulnerability affects the netfilter subsystem, where a data race condition exists when replacing tables due to the lack of a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h (NVD, Ubuntu).

The vulnerability stems from an incorrect implementation of memory barriers in the netfilter subsystem. When a new table value was assigned, it was followed by a write memory barrier (smp_wmb), which only ensured that writes before this point would complete before any writes after this point. However, to properly determine whether the rules are unused, the sequence counter needs to be read, requiring a full memory barrier (smp_mb) to ensure all writes have been completed before these reads (Kernel Commit).

The vulnerability allows attackers to cause a denial of service (system crash) through a null pointer dereference during table replacement. This affects systems where users have CAP_NET_ADMIN capability in any user namespace (Ubuntu, Debian LTS).

The vulnerability can be exploited by a local user with CAP_NET_ADMIN capability in any user namespace. The risk is mitigated on systems where unprivileged users cannot create user namespaces (controlled by the kernel.unprivileged_userns_clone sysctl) (Debian LTS).

The vulnerability was fixed in Linux kernel version 5.11.11 by replacing smp_wmb() with smp_mb() to ensure proper memory barrier implementation. Various distributions have released patches for their respective kernel versions, including Ubuntu, Debian, and Fedora. Systems should be updated to the patched versions (Kernel Commit, Ubuntu).