SECUFOCUSNOW
Home›CVE index›CVE-2024-26924
Review reviewHigh

CVE-2024-26924

Linux Linux, linux_kernel, linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated ele...

CVSS
7.8
EPSS
0.84%
54.3% percentile
CISA KEV
Not listed
Published
2024.04.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.84%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated ele...

Affected product and versions

Product
Linux Linux, linux_kernel, linux kernel
Affected versions
>= 3c4287f62044a90e73a561aa05fc46e62da173da < e3b887a9c11caf8357a821260e095f2a694a34f2, >= 3c4287f62044a90e73a561aa05fc46e62da173da < 7a1679e2d9bfa3b5f8755c2c7113e54b7d42bd46, >= 3c4287f62044a90e73a561aa05fc46e62da173da < 41d8fdf3afaff312e17466e4ab732937738d5644, >= 3c4287f62044a90e73a561aa05fc46e62da173da < ebf7c9746f073035ee26209e38c3a1170f7b349a, >= 3c4287f62044a90e73a561aa05fc46e62da173da < 14b001ba221136c15f894577253e8db535b99487, >= 3c4287f62044a90e73a561aa05fc46e62da173da < 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc, >= 5.6, >= 3c4287f62044, >= 5.6 < 5.10.216, >= 5.11 < 5.15.157, >= 5.16 < 6.1.88, >= 6.2 < 6.6.29, >= 6.7 < 6.8.8, 6.9, 10.0
Fixed versions
5.10.216, 5.15.157, 6.1.88, 6.6.29, 6.8.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux_kernel, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-476
CVE-2024-26924 — Linux Linux, linux_kernel, linux kernel | SECUFOCUS NOW