CVE-2024-27017 (GCVE-0-2024-27017)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:30 – Updated: 2026-08-05 11:29
VLAI
Title
netfilter: nft_set_pipapo: walk over current view on netlink dump
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set. Based on patch from Florian Westphal.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2a90da8e0dd50f42e577988f4219f4f4cd3616b7 , < ff89db14c63a827066446460e39226c0688ef786 (git)
Affected: 45eb6944d0f55102229115de040ef3a48841434a , < ce9fef54c5ec9912a0c9a47bac3195cc41b14679 (git)
Affected: 0d836f917520300a8725a5dbdad4406438d0cead , < 52735a010f37580b3a569a996f878fdd87425650 (git)
Affected: 2b84e215f87443c74ac0aa7f76bb172d43a87033 , < f24d8abc2bb8cbf31ec713336e402eafa8f42f60 (git)
Affected: 2b84e215f87443c74ac0aa7f76bb172d43a87033 , < 721715655c72640567e8742567520c99801148ed (git)
Affected: 2b84e215f87443c74ac0aa7f76bb172d43a87033 , < 29b359cf6d95fd60730533f7f10464e95bd17c73 (git)
Affected: f661383b5f1aaac3fe121b91e04332944bc90193 (git)
Affected: 5.10.186 , < 5.10.227 (semver)
Affected: 5.15.119 , < 5.15.168 (semver)
Affected: 6.1.36 , < 6.1.112 (semver)
Affected: 6.3.10 , < 6.4 (semver)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.112 , ≤ 6.1.* (semver)
Unaffected: 6.6.53 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T16:20:37.656440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:29.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:24.217Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_set_pipapo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff89db14c63a827066446460e39226c0688ef786",
              "status": "affected",
              "version": "2a90da8e0dd50f42e577988f4219f4f4cd3616b7",
              "versionType": "git"
            },
            {
              "lessThan": "ce9fef54c5ec9912a0c9a47bac3195cc41b14679",
              "status": "affected",
              "version": "45eb6944d0f55102229115de040ef3a48841434a",
              "versionType": "git"
            },
            {
              "lessThan": "52735a010f37580b3a569a996f878fdd87425650",
              "status": "affected",
              "version": "0d836f917520300a8725a5dbdad4406438d0cead",
              "versionType": "git"
            },
            {
              "lessThan": "f24d8abc2bb8cbf31ec713336e402eafa8f42f60",
              "status": "affected",
              "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033",
              "versionType": "git"
            },
            {
              "lessThan": "721715655c72640567e8742567520c99801148ed",
              "status": "affected",
              "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033",
              "versionType": "git"
            },
            {
              "lessThan": "29b359cf6d95fd60730533f7f10464e95bd17c73",
              "status": "affected",
              "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f661383b5f1aaac3fe121b91e04332944bc90193",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.227",
              "status": "affected",
              "version": "5.10.186",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.168",
              "status": "affected",
              "version": "5.15.119",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.112",
              "status": "affected",
              "version": "6.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_set_pipapo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.10.186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.15.119",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.112",
                  "versionStartIncluding": "6.1.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.53",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\n\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\n\nBased on patch from Florian Westphal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the nfnetlink/nftables netlink socket (NFT_MSG_GETSETELEM dump raced against transaction commit/abort), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues repeated set-element dumps while another repeatedly commits/aborts transactions to flip the gencursor and free priv-\u003eclone \u2014 and can retry indefinitely; once the wrong branch is latched the free window spans the entire element walk.\nPR:L - nfnetlink_rcv_msg() only requires CAP_NET_ADMIN via netlink_net_capable(), which an unprivileged user obtains in their own network namespace with `unshare -Urn`, where they can freely create pipapo sets and drive both the dump and the transaction.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink threads; no action by any other user or administrator is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority, giving kernel-level compromise rather than crossing a hypervisor, IOMMU, or other scope boundary.\nC:H - The walk reads element pointers and contents from freed memory and copies them straight into the netlink dump reply (nft_data_dump of key/data, plus nla_put of udata-\u003elen bytes at udata-\u003edata), giving a groomable arbitrary kernel-memory read exfiltrated directly to userspace.\nI:H - The element pointer `e` is taken from the freed mt array, so after heap reallocation the attacker controls it, and nf_tables_fill_expr_info() performs an indirect call via `expr-\u003eops-\u003edump()` on that object \u2014 a control-flow hijack primitive enabling privilege escalation.\nA:H - Even without successful exploitation, dereferencing freed/reallocated pipapo match data and wild element pointers produces an oops or panic, and the race can be re-triggered at will to crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:00.212Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679"
        },
        {
          "url": "https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650"
        },
        {
          "url": "https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60"
        },
        {
          "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"
        }
      ],
      "title": "netfilter: nft_set_pipapo: walk over current view on netlink dump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27017",
    "datePublished": "2024-05-01T05:30:01.888Z",
    "dateReserved": "2024-02-19T14:20:24.209Z",
    "dateUpdated": "2026-08-05T11:29:00.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27017",
      "date": "2026-08-07",
      "epss": "0.00294",
      "percentile": "0.21583"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.4\", \"versionEndExcluding\": \"6.8.8\", \"matchCriteriaId\": \"ABBE8A9C-EB49-4236-B78E-D0771D521A7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\\n\\nThe generation mask can be updated while netlink dump is in progress.\\nThe pipapo set backend walk iterator cannot rely on it to infer what\\nview of the datastructure is to be used. Add notation to specify if user\\nwants to read/update the set.\\n\\nBased on patch from Florian Westphal.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: recorra la vista actual en el volcado de netlink. La m\\u00e1scara de generaci\\u00f3n se puede actualizar mientras el volcado de netlink est\\u00e1 en progreso. El iterador de recorrido backend del conjunto pipapo no puede confiar en \\u00e9l para inferir qu\\u00e9 vista de la estructura de datos se va a utilizar. Agregue notaci\\u00f3n para especificar si el usuario desea leer/actualizar el conjunto. Basado en un parche de Florian Westphal.\"}]",
      "id": "CVE-2024-27017",
      "lastModified": "2024-11-21T09:03:40.213",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-01T06:15:20.483",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27017\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:20.483\",\"lastModified\":\"2026-08-04T11:17:33.897\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\\n\\nThe generation mask can be updated while netlink dump is in progress.\\nThe pipapo set backend walk iterator cannot rely on it to infer what\\nview of the datastructure is to be used. Add notation to specify if user\\nwants to read/update the set.\\n\\nBased on patch from Florian Westphal.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: recorra la vista actual en el volcado de netlink. La m\u00e1scara de generaci\u00f3n se puede actualizar mientras el volcado de netlink est\u00e1 en progreso. El iterador de recorrido backend del conjunto pipapo no puede confiar en \u00e9l para inferir qu\u00e9 vista de la estructura de datos se va a utilizar. Agregue notaci\u00f3n para especificar si el usuario desea leer/actualizar el conjunto. Basado en un parche de Florian Westphal.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/netfilter/nf_tables.h\",\"net/netfilter/nf_tables_api.c\",\"net/netfilter/nft_set_pipapo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a90da8e0dd50f42e577988f4219f4f4cd3616b7\",\"lessThan\":\"ff89db14c63a827066446460e39226c0688ef786\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45eb6944d0f55102229115de040ef3a48841434a\",\"lessThan\":\"ce9fef54c5ec9912a0c9a47bac3195cc41b14679\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0d836f917520300a8725a5dbdad4406438d0cead\",\"lessThan\":\"52735a010f37580b3a569a996f878fdd87425650\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b84e215f87443c74ac0aa7f76bb172d43a87033\",\"lessThan\":\"f24d8abc2bb8cbf31ec713336e402eafa8f42f60\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b84e215f87443c74ac0aa7f76bb172d43a87033\",\"lessThan\":\"721715655c72640567e8742567520c99801148ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b84e215f87443c74ac0aa7f76bb172d43a87033\",\"lessThan\":\"29b359cf6d95fd60730533f7f10464e95bd17c73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f661383b5f1aaac3fe121b91e04332944bc90193\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.186\",\"lessThan\":\"5.10.227\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.119\",\"lessThan\":\"5.15.168\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.36\",\"lessThan\":\"6.1.112\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.3.10\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/netfilter/nf_tables.h\",\"net/netfilter/nf_tables_api.c\",\"net/netfilter/nft_set_pipapo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.112\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.53\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-28T16:20:37.656440Z\",\"id\":\"CVE-2024-27017\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"ABBE8A9C-EB49-4236-B78E-D0771D521A7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T03:52:34+00:00",
      "cve": "CVE-2024-27017",
      "id": "CVE-2024-27017",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27017.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:54:04Z",
      "cve": "CVE-2024-27017",
      "id": "CVE-2024-27017",
      "initial_release_date": "2024-05-03T02:09:39Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "387",
      "product_status:recommended": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27017",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27017.json",
      "version": "71"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:17:24.217Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27017\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-28T16:20:37.656440Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-28T16:20:44.217Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"netfilter: nft_set_pipapo: walk over current view on netlink dump\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through the nfnetlink/nftables netlink socket (NFT_MSG_GETSETELEM dump raced against transaction commit/abort), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\\nAC:L - The attacker controls both sides of the race \\u2014 one thread issues repeated set-element dumps while another repeatedly commits/aborts transactions to flip the gencursor and free priv-\u003eclone \\u2014 and can retry indefinitely; once the wrong branch is latched the free window spans the entire element walk.\\nPR:L - nfnetlink_rcv_msg() only requires CAP_NET_ADMIN via netlink_net_capable(), which an unprivileged user obtains in their own network namespace with `unshare -Urn`, where they can freely create pipapo sets and drive both the dump and the transaction.\\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink threads; no action by any other user or administrator is needed.\\nS:U - The use-after-free corrupts kernel memory within the same security authority, giving kernel-level compromise rather than crossing a hypervisor, IOMMU, or other scope boundary.\\nC:H - The walk reads element pointers and contents from freed memory and copies them straight into the netlink dump reply (nft_data_dump of key/data, plus nla_put of udata-\u003elen bytes at udata-\u003edata), giving a groomable arbitrary kernel-memory read exfiltrated directly to userspace.\\nI:H - The element pointer `e` is taken from the freed mt array, so after heap reallocation the attacker controls it, and nf_tables_fill_expr_info() performs an indirect call via `expr-\u003eops-\u003edump()` on that object \\u2014 a control-flow hijack primitive enabling privilege escalation.\\nA:H - Even without successful exploitation, dereferencing freed/reallocated pipapo match data and wild element pointers produces an oops or panic, and the race can be re-triggered at will to crash the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2a90da8e0dd50f42e577988f4219f4f4cd3616b7\", \"lessThan\": \"ff89db14c63a827066446460e39226c0688ef786\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"45eb6944d0f55102229115de040ef3a48841434a\", \"lessThan\": \"ce9fef54c5ec9912a0c9a47bac3195cc41b14679\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0d836f917520300a8725a5dbdad4406438d0cead\", \"lessThan\": \"52735a010f37580b3a569a996f878fdd87425650\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b84e215f87443c74ac0aa7f76bb172d43a87033\", \"lessThan\": \"f24d8abc2bb8cbf31ec713336e402eafa8f42f60\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b84e215f87443c74ac0aa7f76bb172d43a87033\", \"lessThan\": \"721715655c72640567e8742567520c99801148ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b84e215f87443c74ac0aa7f76bb172d43a87033\", \"lessThan\": \"29b359cf6d95fd60730533f7f10464e95bd17c73\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f661383b5f1aaac3fe121b91e04332944bc90193\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.186\", \"lessThan\": \"5.10.227\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.119\", \"lessThan\": \"5.15.168\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.36\", \"lessThan\": \"6.1.112\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.3.10\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}], \"programFiles\": [\"include/net/netfilter/nf_tables.h\", \"net/netfilter/nf_tables_api.c\", \"net/netfilter/nft_set_pipapo.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.112\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.53\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/netfilter/nf_tables.h\", \"net/netfilter/nf_tables_api.c\", \"net/netfilter/nft_set_pipapo.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786\"}, {\"url\": \"https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679\"}, {\"url\": \"https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650\"}, {\"url\": \"https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60\"}, {\"url\": \"https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed\"}, {\"url\": \"https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\\n\\nThe generation mask can be updated while netlink dump is in progress.\\nThe pipapo set backend walk iterator cannot rely on it to infer what\\nview of the datastructure is to be used. Add notation to specify if user\\nwants to read/update the set.\\n\\nBased on patch from Florian Westphal.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"5.10.186\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.15.119\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.112\", \"versionStartIncluding\": \"6.1.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.53\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:00.212Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27017\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:00.212Z\", \"dateReserved\": \"2024-02-19T14:20:24.209Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:30:01.888Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.