https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:01:28 +0000 https://vulnerability.circl.lu/vuln/cve-2024-57947 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_set_pipapo: fix initial map fill</p> <p>The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size.</p> <p>After each round in the map search step, the result and the fill map are swapped, so if we have a set where f-&gt;bsize of the first element is smaller than m-&gt;bsize_max, those one-bits are leaked into future rounds result map.</p> <p>This makes pipapo find an incorrect matching results for sets where first field size is not the largest.</p> <p>Followup patch adds a test case to nft_concat_range.sh selftest script.</p> <p>Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn&#39;t enough.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_set_pipapo: fix initial map fill</p> <p>The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size.</p> <p>After each round in the map search step, the result and the fill map are swapped, so if we have a set where f-&gt;bsize of the first element is smaller than m-&gt;bsize_max, those one-bits are leaked into future rounds result map.</p> <p>This makes pipapo find an incorrect matching results for sets where first field size is not the largest.</p> <p>Followup patch adds a test case to nft_concat_range.sh selftest script.</p> <p>Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn&#39;t enough.</p> https://vulnerability.circl.lu/vuln/cve-2024-57947