CVE-2024-35900
netfilter: nf_tables: reject new basechain after table flag update
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: reject new basechain after table flag update
When dormant flag is toggled, hooks are disabled in the commit phase by
iterating over current chains in table (existing and new).
The following configuration allows for an inconsistent state:
add table x
add chain x y { type filter hook input priority 0; }
add table x { flags dormant; }
add chain x w { type filter hook input priority 1; }
which triggers the following warning when trying to unregister chain w
which is already unregistered.
[ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260
[...]
[ 127.322519] Call Trace:
[ 127.322521] <TASK>
[ 127.322524] ? __warn+0x9f/0x1a0
[ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260
[ 127.322537] ? report_bug+0x1b1/0x1e0
[ 127.322545] ? handle_bug+0x3c/0x70
[ 127.322552] ? exc_invalid_op+0x17/0x40
[ 127.322556] ? asm_exc_invalid_op+0x1a/0x20
[ 127.322563] ? kasan_save_free_info+0x3b/0x60
[ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260
[ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260
[ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260
[ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables]
[ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables]
[ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_tables: rechazar nueva cadena base después de actualizar la bandera de la tabla Cuando se activa la bandera inactiva, los enlaces se desactivan en la fase de confirmación al iterar sobre las cadenas actuales en la tabla (existentes y nuevas). La siguiente configuración permite un estado inconsistente: agregar tabla x agregar cadena xy { tipo filtro gancho entrada prioridad 0; } agregar tabla x {banderas inactivas; } agregar cadena xw {tipo filtro gancho entrada prioridad 1; } que activa la siguiente advertencia al intentar cancelar el registro de la cadena w que ya está cancelada. [127.322252] ADVERTENCIA: CPU: 7 PID: 1211 en net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Seguimiento de llamadas: [ 127.322521] [ 127.322524] ? __advertir+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [127.322537]? report_bug+0x1b1/0x1e0 [127.322545]? handle_bug+0x3c/0x70 [127.322552]? exc_invalid_op+0x17/0x40 [127.322556]? asm_exc_invalid_op+0x1a/0x20 [127.322563]? kasan_save_free_info+0x3b/0x60 [127.322570]? __nf_unregister_net_hook+0x6a/0x260 [127.322577]? __nf_unregister_net_hook+0x21a/0x260 [127.322583]? __nf_unregister_net_hook+0x6a/0x260 [127.322590]? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-05-17 CVE Reserved
- 2024-05-19 CVE Published
- 2024-05-20 EPSS Updated
- 2024-12-19 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (14)
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2024-35900 | 2024-11-12 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2281664 | 2024-11-12 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.4.262 < 5.4.274 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.4.262 < 5.4.274" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.10.202 < 5.10.215 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10.202 < 5.10.215" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.13 < 5.15.154 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.13 < 5.15.154" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.13 < 6.1.85 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.13 < 6.1.85" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.13 < 6.6.26 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.13 < 6.6.26" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.13 < 6.8.5 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.13 < 6.8.5" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.13 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.13 < 6.9" | en |
Affected
|