Description
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kernel
Default version status: unaffected
0 to < 6.7-rc2affected
Red Hat Red Hat Enterprise Linux 6
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
References
- https://access.redhat.com/security/cve/CVE-2024-0607 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2258635 ↗
- https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗