Linux Netfilter nftables Use-After-Free Enables Local Root Escalation

A use-after-free write flaw in the Linux kernel's Netfilter nf_tables/nftables subsystem, tracked as CVE-2022-32250, can allow a local attacker to escalate privileges to root. The defect is triggered by supplying a non-stateful lookup or dynset expression as a subexpression in an NFT_MSG_NEWSET operation: the expression is bound to a set, then freed without removal from the set's binding list, leaving a stale reference that can be used for memory corruption.

Researchers demonstrated exploitation on Ubuntu 22.04 running kernel 5.15.0-27-generic, using user_key_payload and POSIX message queues to leak heap and KASLR addresses before overwriting modprobe_path for root execution. Exploitation requires the ability to create user and network namespaces. The upstream fix, committed as 520778042ccca019f3ffa136dd0ca565c486cedd, moves NFT_EXPR_STATEFUL validation into nft_expr_init so unsupported expressions are rejected before allocation and binding can create the dangling reference.