netfilter: nf_tables: reject new basechain after table flag update (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y { type filter hook input priority 0; } add table x { flags dormant; } add chain x w { type filter hook input priority 1; } which triggers the following warning when trying to unregister chain w which is already unregistered. [ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] <TASK> [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
References
- https://git.kernel.org/stable/c/6d12f21f8bbe23fde25b77c2bf5973c136b8bef8
- https://git.kernel.org/stable/c/41bad13c0e8a5a2b47a7472cced922555372daab
- https://git.kernel.org/stable/c/7b6fba6918714afee3e17796113ccab636255c7b
- https://git.kernel.org/stable/c/8ba81dca416adf82fc5a2a23abc1a8cc02ad32fb
- https://git.kernel.org/stable/c/745cf6a843896cdac8766c74379300ed73c78830
- https://git.kernel.org/stable/c/420132bee3d0136b7fba253a597b098fe15493a7
- https://git.kernel.org/stable/c/e95bb4cba94c018be24b11f017d1c55dd6cda31a
- https://git.kernel.org/stable/c/994209ddf4f430946f6247616b2e33d179243769
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-35618
- GCVE · GCVE-0-2024-35900
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0335 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0668 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0645 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0633 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0632 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0611 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0578 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0527 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.262 < 5.4.274cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.202 < 5.10.215cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.13.1 < 5.15.154cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.85cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.26cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.8.5cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.13:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3 < 6d12f21f8bbe23fde25b77c2bf5973c136b8bef8 ; affected e10f661adc556c4969c70ddaddf238bffdaf1e87 < 41bad13c0e8a5a2b47a7472cced922555372daab ; affected d9c4da8cb74e8ee6e58a064a3573aa37acf6c935 < 7b6fba6918714afee3e17796113ccab636255c7b ; affected 179d9ba5559a756f4322583388b3213fe4e391b0 < 8ba81dca416adf82fc5a2a23abc1a8cc02ad32fb ; affected 179d9ba5559a756f4322583388b3213fe4e391b0 < 745cf6a843896cdac8766c74379300ed73c78830 ; affected 179d9ba5559a756f4322583388b3213fe4e391b0 < 420132bee3d0136b7fba253a597b098fe15493a7 |
| Linux · Linux | affected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.4.274 ≤ 5.4.* ; unaffected 5.10.215 ≤ 5.10.* ; unaffected 5.15.154 ≤ 5.15.* ; unaffected 6.1.85 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |