cve-2024-27011
Vulnerability from cvelistv5
Published
2024-05-01 05:29
Modified
2024-08-02 00:21
Severity
Summary
netfilter: nf_tables: fix memleak in map from abort path
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/49d0e656d19dfb2d4d7c230e4a720d37b3decff6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86a1471d7cde792941109b93b558b5dc078b9ee9
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:56:26.241509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T18:56:33.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/49d0e656d19dfb2d4d7c230e4a720d37b3decff6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86a1471d7cde792941109b93b558b5dc078b9ee9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49d0e656d19d",
              "status": "affected",
              "version": "591054469b3e",
              "versionType": "git"
            },
            {
              "lessThan": "86a1471d7cde",
              "status": "affected",
              "version": "591054469b3e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix memleak in map from abort path\n\nThe delete set command does not rely on the transaction object for\nelement removal, therefore, a combination of delete element + delete set\nfrom the abort path could result in restoring twice the refcount of the\nmapping.\n\nCheck for inactive element in the next generation for the delete element\ncommand in the abort path, skip restoring state if next generation bit\nhas been already cleared. This is similar to the activate logic using\nthe set walk iterator.\n\n[ 6170.286929] ------------[ cut here ]------------\n[ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.287071] Modules linked in: [...]\n[ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365\n[ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 \u003c0f\u003e 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f\n[ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202\n[ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000\n[ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750\n[ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55\n[ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10\n[ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100\n[ 6170.287940] FS:  0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000\n[ 6170.287948] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0\n[ 6170.287962] Call Trace:\n[ 6170.287967]  \u003cTASK\u003e\n[ 6170.287973]  ? __warn+0x9f/0x1a0\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\n[ 6170.288104]  ? handle_bug+0x3c/0x70\n[ 6170.288112]  ? exc_invalid_op+0x17/0x40\n[ 6170.288120]  ? asm_exc_invalid_op+0x1a/0x20\n[ 6170.288132]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\n[ 6170.288243]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288366]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\n[ 6170.288483]  nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:26:59.434Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49d0e656d19dfb2d4d7c230e4a720d37b3decff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/86a1471d7cde792941109b93b558b5dc078b9ee9"
        }
      ],
      "title": "netfilter: nf_tables: fix memleak in map from abort path",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27011",
    "datePublished": "2024-05-01T05:29:33.090Z",
    "dateReserved": "2024-02-19T14:20:24.208Z",
    "dateUpdated": "2024-08-02T00:21:05.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27011\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:19.583\",\"lastModified\":\"2024-05-13T08:15:11.983\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: fix memleak in map from abort path\\n\\nThe delete set command does not rely on the transaction object for\\nelement removal, therefore, a combination of delete element + delete set\\nfrom the abort path could result in restoring twice the refcount of the\\nmapping.\\n\\nCheck for inactive element in the next generation for the delete element\\ncommand in the abort path, skip restoring state if next generation bit\\nhas been already cleared. This is similar to the activate logic using\\nthe set walk iterator.\\n\\n[ 6170.286929] ------------[ cut here ]------------\\n[ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\\n[ 6170.287071] Modules linked in: [...]\\n[ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365\\n[ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\\n[ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 \u003c0f\u003e 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f\\n[ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202\\n[ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000\\n[ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750\\n[ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55\\n[ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10\\n[ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100\\n[ 6170.287940] FS:  0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000\\n[ 6170.287948] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0\\n[ 6170.287962] Call Trace:\\n[ 6170.287967]  \u003cTASK\u003e\\n[ 6170.287973]  ? __warn+0x9f/0x1a0\\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\\n[ 6170.288104]  ? handle_bug+0x3c/0x70\\n[ 6170.288112]  ? exc_invalid_op+0x17/0x40\\n[ 6170.288120]  ? asm_exc_invalid_op+0x1a/0x20\\n[ 6170.288132]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\\n[ 6170.288243]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\\n[ 6170.288366]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\\n[ 6170.288483]  nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: nf_tables: corrige memleak en el mapa de la ruta de aborto El comando eliminar conjunto no depende del objeto de transacci\u00f3n para la eliminaci\u00f3n de elementos, por lo tanto, se puede usar una combinaci\u00f3n de eliminar elemento + eliminar conjunto del abortar la ruta podr\u00eda resultar en restaurar el doble del recuento del mapeo. Verifique si hay elementos inactivos en la pr\u00f3xima generaci\u00f3n para el comando de eliminaci\u00f3n de elementos en la ruta de cancelaci\u00f3n, omita el estado de restauraci\u00f3n si el bit de pr\u00f3xima generaci\u00f3n ya se ha borrado. Esto es similar a la l\u00f3gica de activaci\u00f3n usando el iterador de caminata establecido. [6170.286929] ------------[ cortar aqu\u00ed ]------------ [ 6170.286939] ADVERTENCIA: CPU: 6 PID: 790302 en net/netfilter/nf_tables_api.c :2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] M\u00f3dulos vinculados en: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 No contaminado 6.9.0-rc3+ #365 [ 768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [6170.287886] C\u00f3digo: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b gl 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 \u0026lt;0f\u0026gt; 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 LAGS: 00010202 [6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: 811ebe4700 R08: ffff88838e812650 R09: ffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 00000000000000001 R12: ffff888125bffb10 [ 6170.287 933] R13: ffff888125bffb10 R14: muerto000000000122 R15: muerto000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287 948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Seguimiento de llamadas: [ 6170.287967]  [ 6170.287973] ? __advertir+0x9f/0x1a0 [6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [6170.288092]? report_bug+0x1b1/0x1e0 [6170.287986]? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [6170.288092]? report_bug+0x1b1/0x1e0 [6170.288104]? handle_bug+0x3c/0x70 [6170.288112]? exc_invalid_op+0x17/0x40 [6170.288120]? asm_exc_invalid_op+0x1a/0x20 [6170.288132]? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [6170.288243]? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [6170.288366]? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49d0e656d19dfb2d4d7c230e4a720d37b3decff6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86a1471d7cde792941109b93b558b5dc078b9ee9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.