CVE-2024-26809

Published Apr 4, 2024

Last updated 2 months ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-26809 is a vulnerability in the Linux kernel, specifically within the netfilter subsystem, which is responsible for network packet filtering. The vulnerability occurs in the `nft_set_pipapo` component and arises from releasing elements in a clone operation only from the destroy path. The core issue is that the clone operation already provides a current view of the lookup table. By using this view to destroy the set, it prevents the possibility of destroying elements twice, which could lead to memory corruption or other undefined behavior. The fix for this vulnerability requires specific patches to be applied to the kernel.

Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") which came after: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "22B07DEF-9858-4D7B-ACDE-078D5421F0D5",
            "versionEndExcluding": "5.10.214",
            "versionStartIncluding": "5.10.130"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9C0EF0BE-4A28-471E-B665-E3CB7A66436C",
            "versionEndExcluding": "5.15.153",
            "versionStartIncluding": "5.15.54"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C0C1B61-8338-4B49-BB56-B33CD1C6BA3A",
            "versionEndExcluding": "6.1.83",
            "versionStartIncluding": "5.18.11"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E00814DC-0BA7-431A-9926-80FEB4A96C68",
            "versionEndExcluding": "6.6.23",
            "versionStartIncluding": "6.2"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD",
            "versionEndExcluding": "6.7.11",
            "versionStartIncluding": "6.7"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1",
            "versionEndExcluding": "6.8.2",
            "versionStartIncluding": "6.8"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.