Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause system instability or gain unauthorized privileges. The issue exists in the nf_tables component, which is responsible for firewall and packet filtering rules. An attacker with local access could exploit this flaw to bypass security controls or disrupt network operations.
Technical details
A vulnerability was identified in the Linux kernel's netfilter nf_tables API where internal table flags were incorrectly compared during updates. Specifically, in the nf_tables_updtable function, the kernel failed to mask internal flags when comparing the requested update flags with existing table flags. This logic error could prevent the kernel from correctly skipping redundant transactions or properly validating state changes. A local attacker with low privileges could exploit this to trigger unintended state transitions in the firewall configuration. The fix involves applying a bitmask (NFT_TABLE_F_MASK) to ensure only user-facing flags are compared during updates. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.4.262 to 5.4.273, 5.10.202 to 5.10.214, 5.13.1 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-03-21: patched: Initial patch committed to mainline kernel.
- 2024-05-01: disclosed: CVE published.
References
- https://git.kernel.org/stable/c/2531f907d3e40a6173090f10670ae76d117ab27b
- https://git.kernel.org/stable/c/3443e57654f90c9a843ab6a6040c10709fd033aa
- https://git.kernel.org/stable/c/4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139
- https://git.kernel.org/stable/c/4d37f12707ee965d338028732575f0b85f6d9e4f
- https://git.kernel.org/stable/c/640dbf688ba955e83e03de84fbdda8e570b7cce4
- https://git.kernel.org/stable/c/845083249d6a392f3a88804e1669bdb936ee129f
- https://git.kernel.org/stable/c/9683cb6c2c6c0f45537bf0b8868b5d38fcb63fc7