CVE-2024-39503
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. The patch contains the following parts: - When destroying all sets, first remove the garbage collectors, then wait if needed and then destroy the sets. - Fix the badly ordered "wait then remove gc" for the destroy a single set case. - Fix the missing rcu locking in the list:set type in the userspace test case. - Use proper RCU list handlings in the list:set type. The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3
- https://git.kernel.org/stable/c/93b53c202b51a69e42ca57f5a183f7e008e19f83
- https://git.kernel.org/stable/c/0f1bb77c6d837c9513943bc7c08f04c5cc5c6568
- https://git.kernel.org/stable/c/390b353d1a1da3e9c6c0fd14fe650d69063c95d6
- https://git.kernel.org/stable/c/2ba35b37f780c6410bb4bba9c3072596d8576702
- https://git.kernel.org/stable/c/90ae20d47de602198eb69e6cd7a3db3420abfc08
- https://git.kernel.org/stable/c/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-38029
- GCVE · GCVE-0-2024-39503
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0401 — Multiples vulnérabilités dans Juniper Networks Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0106 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0956 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0838 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0823 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0778 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0613 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.269 < 5.4.279cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.210 < 5.10.221cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.149 < 5.15.162cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.79 < 6.1.95cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.18 < 6.6.35cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7.6 < 6.8cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.8.1 < 6.9.6cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected c7f2733e5011bfd136f1ca93497394d43aa76225 < c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3 ; affected a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 < 93b53c202b51a69e42ca57f5a183f7e008e19f83 ; affected c2dc077d8f722a1c73a24e674f925602ee5ece49 < 0f1bb77c6d837c9513943bc7c08f04c5cc5c6568 ; affected 653bc5e6d9995d7d5f497c665b321875a626161c < 390b353d1a1da3e9c6c0fd14fe650d69063c95d6 ; affected b93a6756a01f4fd2f329a39216f9824c56a66397 < 2ba35b37f780c6410bb4bba9c3072596d8576702 ; affected 97f7cf1cd80eeed3b7c808b7c12463295c751001 < 90ae20d47de602198eb69e6cd7a3db3420abfc08 |
| Linux · Linux | affected 6.8 ; unaffected 0 < 6.8 ; unaffected 5.4.279 ≤ 5.4.* ; unaffected 5.10.221 ≤ 5.10.* ; unaffected 5.15.162 ≤ 5.15.* ; unaffected 6.1.95 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |