ANT-2026-KRKYEBGE · nftables

other high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Opus 4.6

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-KRKYEBGE: write-primitive in nftables

In json_parse_map_stmt(), the parser calls json_parse_set_stmt_list(ctx, &stmt->set.stmt_list, ...) on a map statement, but set_stmt.stmt_list and map_stmt.data share offset 16 in the enclosing C union. list_add() therefore overwrites stmt->map.data (a valid expr*) with a pointer to a stmt object and also corrupts expr_data->list.prev on the heap. When expr_evaluate() later dereferences stmt->map.data as an expr, it reads stmt fields at expr offsets; the JSON-supplied limit_stmt.burst value lands at the expr.key pointer offset, so an attacker controls the upper 32 bits of a pointer that is subsequently dereferenced (e.g. burst=0x41414141 → RAX=0x4141414100000000). This yields a controlled read target plus a heap write primitive, plausibly chainable toward code execution in a non-ASAN build.

Target

Project: nftables
Location: src/parser_json.c:2584 (json_parse_map_stmt)

Technical Details

Root cause is a copy-paste error: parser_json.c:2584 passes &stmt->set.stmt_list instead of &stmt->map.stmt_list, and because both live in the same union at offset 16, list_add() clobbers stmt->map.data. ASAN reports SEGV in expr_evaluate (evaluate.c:3167) — "address points to the zero page" with a counter stmt, or "dereference of a high value address" with a controlled burst — confirming the stmt object is being read through expr field offsets with attacker-influenced pointer content.

Crash signature: ASAN SEGV on attacker-controlled high-value address dereference in expr_evaluate at evaluate.c:3167

Reproduction

Create a table, a dynamic map, and a chain via JSON
Add a rule containing a "map" expression with op=add, elem, data, map=@m, and a "stmt" array containing a limit statement with an attacker-chosen burst value (e.g. 0x41414141)
json_parse_set_stmt_list() writes the stmt list head through &stmt->set.stmt_list, which aliases &stmt->map.data, overwriting the valid expr pointer and corrupting expr_data->list.prev
During evaluation, expr_evaluate() dereferences stmt->map.data as an expr; limit.burst lands at the expr.key offset, so RAX upper 32 bits equal the burst value and *(RAX+0x39) is read

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-KRKYEBGE.

Reference: ANT-2026-KRKYEBGE
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-03-24 Reported to tracker
2026-05-20 Patch released
2026-05-20 Maintainer acknowledged
2026-05-28 Sent to maintainer
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

70fb09becc7548819b6f38c1750c0c600d49c09f63f13099be0d665b42a7605dd607820bc1eb562d1f15a5f29c057b6ac1fcaf4ad108402467db81c5ef011064

Committed 2026-05-28 08:14 PT

Revealed 2026-08-17 13:03 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-KRKYEBGE",
  "bug_class": "write-primitive",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-24T18:47:47+00:00",
  "description": "In json_parse_map_stmt(), the parser calls json_parse_set_stmt_list(ctx, &stmt->set.stmt_list, ...) on a map statement, but set_stmt.stmt_list and map_stmt.data share offset 16 in the enclosing C union. list_add() therefore overwrites stmt->map.data (a valid expr*) with a pointer to a stmt object and also corrupts expr_data->list.prev on the heap. When expr_evaluate() later dereferences stmt->map.data as an expr, it reads stmt fields at expr offsets; the JSON-supplied limit_stmt.burst value lands at the expr.key pointer offset, so an attacker controls the upper 32 bits of a pointer that is subsequently dereferenced (e.g. burst=0x41414141 → RAX=0x4141414100000000). This yields a controlled read target plus a heap write primitive, plausibly chainable toward code execution in a non-ASAN build.",
  "discovered_at": null,
  "location": "src/parser_json.c:2584 (json_parse_map_stmt)",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "nftables",
  "reproduction": [
    "1. Create a table, a dynamic map, and a chain via JSON",
    "2. Add a rule containing a \"map\" expression with op=add, elem, data, map=@m, and a \"stmt\" array containing a limit statement with an attacker-chosen burst value (e.g. 0x41414141)",
    "3. json_parse_set_stmt_list() writes the stmt list head through &stmt->set.stmt_list, which aliases &stmt->map.data, overwriting the valid expr pointer and corrupting expr_data->list.prev",
    "4. During evaluation, expr_evaluate() dereferences stmt->map.data as an expr; limit.burst lands at the expr.key offset, so RAX upper 32 bits equal the burst value and *(RAX+0x39) is read"
  ],
  "technical_details": "Root cause is a copy-paste error: parser_json.c:2584 passes &stmt->set.stmt_list instead of &stmt->map.stmt_list, and because both live in the same union at offset 16, list_add() clobbers stmt->map.data. ASAN reports SEGV in expr_evaluate (evaluate.c:3167) — \"address points to the zero page\" with a counter stmt, or \"dereference of a high value address\" with a controlled burst — confirming the stmt object is being read through expr field offsets with attacker-influenced pointer content.",
  "title": "write-primitive in nftables",
  "vendor_severity": "high"
}