Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

netfilter: nf_tables: use timestamp to check for set element timeout (Linux Linux)

CVE-2024-27397
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.26 % · centile 18 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Rechercher sur…

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished. .lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue.

Faiblesses (CWE)

  • CWE-416 — Utilisation après libération

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected c3e1b005ed1cc068fc9d454a6e745830d55d251d < f8dfda798650241c1692058713ca4fef8e429061 ; affected c3e1b005ed1cc068fc9d454a6e745830d55d251d < eaf1a29ea5d7dba8e84e9e9f3b3f47d0cd540bfe ; affected c3e1b005ed1cc068fc9d454a6e745830d55d251d < 7b17de2a71e56c10335b565cc7ad238e6d984379 ; affected c3e1b005ed1cc068fc9d454a6e745830d55d251d < 0d40e8cb1d1f56a994cdd2e015af622fdca9ed4d ; affected c3e1b005ed1cc068fc9d454a6e745830d55d251d < b45176b869673417ace338b87cf9cdb66e2eeb01 ; affected c3e1b005ed1cc068fc9d454a6e745830d55d251d < 7fa2e2960fff8322ce2ded57b5f8e9cbc450b967
Linux · Linuxaffected 4.1 ; unaffected 0 < 4.1 ; unaffected 4.19.320 ≤ 4.19.* ; unaffected 5.4.282 ≤ 5.4.* ; unaffected 5.10.224 ≤ 5.10.* ; unaffected 5.15.165 ≤ 5.15.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD