Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the netfilter component used for firewalling and packet filtering. An issue in how the system calculates memory requirements for certain firewall rules could allow a local user to cause a system crash or instability. This affects the availability of the system but does not directly expose customer data.
Technical details
A vulnerability exists in the nf_tables component of the Linux kernel due to improper validation of concatenated set key lengths. In the `nft_set_desc_concat` function, register-based arithmetic allowed for a mismatch between the total set key length (aligned to 32-bits) and the sum of individual field lengths (each rounded up to 32-bits). For example, a set key length of 10 combined with field descriptions of [5, 4] could lead to an incorrect pipapo rule width of 12. This inconsistency can be exploited by a local attacker with low privileges to trigger kernel instability or a denial of service (DoS). The fix ensures that the rounded-up sum of field lengths strictly matches the set key length.
Affected products
- Linux Linux Kernel 5.10.209 to 5.10.235, 5.15.148 to 5.15.179, 6.1.75 to 6.1.129, 6.6.14 to 6.6.76, 6.7.2 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2025-01-28: other: Patch authored
- 2025-03-06: advisory: NVD Published Date
- 2025-03-06: patched: Initial fix committed to stable tree
References
- https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220
- https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752
- https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d
- https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3
- https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f
- https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32
- https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6