CVE-2024-39503

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. The patch contains the following parts: - When destroying all sets, first remove the garbage collectors, then...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= c7f2733e5011bfd136f1ca93497394d43aa76225 < c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3, >= a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 < 93b53c202b51a69e42ca57f5a183f7e008e19f83, >= c2dc077d8f722a1c73a24e674f925602ee5ece49 < 0f1bb77c6d837c9513943bc7c08f04c5cc5c6568, >= 653bc5e6d9995d7d5f497c665b321875a626161c < 390b353d1a1da3e9c6c0fd14fe650d69063c95d6, >= b93a6756a01f4fd2f329a39216f9824c56a66397 < 2ba35b37f780c6410bb4bba9c3072596d8576702, >= 97f7cf1cd80eeed3b7c808b7c12463295c751001 < 90ae20d47de602198eb69e6cd7a3db3420abfc08, >= 97f7cf1cd80eeed3b7c808b7c12463295c751001 < 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10, >= 970709a67696b100a57b33af1a3d75fc34b747eb, >= 5.4.269 < 5.4.279, >= 5.10.210 < 5.10.221, >= 5.15.149 < 5.15.162, >= 6.1.79 < 6.1.95, >= 6.6.18 < 6.6.35, >= 6.7.6 < 6.8, >= 6.8, < V3.1, >= 6.8.1 < 6.9.6, 6.8, 6.10

Fixed versions

5.4.279, 5.10.221, 5.15.162, 6.1.95, 6.6.35, 6.8, 6.9.6

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-362, CWE-416