Junglewise Threat Intelligence

CVE-2024-26642: Linux Kernel denial of service in netfilter nf_tables

CVE-2024-26642 · Severity: medium · CVSS 5.5 · Published 2024-03-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking subsystem (netfilter) that could allow a local user to cause a system crash. The issue stems from how the system handles temporary, unnamed sets of data used for firewall rules. By providing specific invalid configurations, an attacker can trigger an internal error that leads to a denial of service.

Technical details

A vulnerability in the nf_tables component of the Linux kernel (specifically in net/netfilter/nf_tables_api.c) allowed the creation of anonymous sets with the NFT_SET_TIMEOUT flag. While userspace typically does not use timeouts with anonymous sets, the kernel failed to explicitly reject this combination unless the NFT_SET_EVAL flag was also present (which is required for legacy meters). A local attacker with low privileges could exploit this logic flaw to trigger undefined behavior or a kernel panic, resulting in a denial of service. The fix involves adding a check in nf_tables_newset() to reject configurations where NFT_SET_ANONYMOUS and NFT_SET_TIMEOUT are set without NFT_SET_EVAL.

Affected products

  • Linux Linux Kernel 4.1 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12

Timeline

  • 2024-03-01: patched: Initial patch authored by Pablo Neira Ayuso
  • 2024-03-21: disclosed: CVE published

References

Related threats