CVE-2022-48935: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48935 affects the Linux kernel's netfilter subsystem, specifically related to the nf_tables component. The vulnerability was discovered and disclosed in August 2024, involving a use-after-free issue in the netfilter flowtable hooks during network namespace exit. This vulnerability affects multiple versions of the Linux kernel, from versions prior to 4.19.316 up to versions before 5.16.12 (NVD).

The vulnerability occurs when flowtable hooks are released via nf_tables_flowtable_destroy() before they are properly unregistered, leading to a use-after-free condition. The issue manifests in the nf_hook_entries_grow function at net/netfilter/core.c line 142. The CVSS v3.1 base score for this vulnerability is 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a use-after-free condition in the kernel's network filtering subsystem, potentially causing system crashes or denial of service. The issue specifically affects the netfilter's flow table functionality during network namespace cleanup (Kernel Patch).

The vulnerability requires local access with low privileges to exploit. It can be triggered during network namespace exit operations when using netfilter flow tables. The issue was discovered through automated testing using the syzkaller kernel fuzzing tool (Kernel Patch).

The issue has been fixed by modifying the hook unregistration sequence in the netfilter subsystem. The fix ensures that flowtable hooks are unregistered before they are released via nf_tables_flowtable_destroy(). After an RCU grace period, it is guaranteed that no packets can add new entries to the flowtable, making it safe to clean up the remaining entries (Kernel Patch).