{"id":"CVE-2024-27414","state":"PUBLISHED","title":"rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back\n\nIn the commit d73ef2d69c0d (\"rtnetlink: let rtnl_bridge_setlink checks\nIFLA_BRIDGE_MODE length\"), an adjustment was made to the old loop logic\nin the function `rtnl_bridge_setlink` to enable the loop to also check\nthe length of the IFLA_BRIDGE_MODE attribute. However, this adjustment\nremoved the `break` statement and led to an error logic of the flags\nwriting back at the end of this function.\n\nif (have_flags)\n    memcpy(nla_data(attr), &flags, sizeof(flags));\n    // attr should point to IFLA_BRIDGE_FLAGS NLA !!!\n\nBefore the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS.\nHowever, this is not necessarily true fow now as the updated loop will let\nthe attr point to the last NLA, even an invalid NLA which could cause\noverflow writes.\n\nThis patch introduces a new variable `br_flag` to save the NLA pointer\nthat points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned\nerror logic.","publishedAt":"2024-05-17T11:50:57.207Z","updatedAt":"2026-08-05T11:29:43.204Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ad46d4861ed36315d3d9e838723ba3e367ecc042","status":"affected","lessThan":"b9fbc44159dfc3e9a7073032752d9e03f5194a6f","versionType":"git"},{"version":"abb0172fa8dc4a4ec51aa992b7269ed65959f310","status":"affected","lessThan":"882a51a10ecf24ce135d573afa0872aef02c5125","versionType":"git"},{"version":"047508edd602921ee8bb0f2aa2100aa2e9bedc75","status":"affected","lessThan":"a1227b27fcccc99dc44f912b479e01a17e2d7d31","versionType":"git"},{"version":"8dfac8071d58447e5cace4c4c6fe493ce2f615f6","status":"affected","lessThan":"f2261eb994aa5757c1da046b78e3229a3ece0ad9","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"167d8642daa6a44b51de17f8ff0f584e1e762db7","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"831bc2728fb48a8957a824cba8c264b30dca1425","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"743ad091fb46e622f1b690385bb15e3cd3daf874","versionType":"git"},{"version":"00757f58e37b2d9a6f99e15be484712390cd2bab","status":"affected","versionType":"git"},{"version":"5.4.253","status":"affected","lessThan":"5.4.271","versionType":"semver"},{"version":"5.10.190","status":"affected","lessThan":"5.10.212","versionType":"semver"},{"version":"5.15.126","status":"affected","lessThan":"5.15.151","versionType":"semver"},{"version":"6.1.45","status":"affected","lessThan":"6.1.81","versionType":"semver"},{"version":"6.4.10","status":"affected","lessThan":"6.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/rtnetlink.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"5.4.271","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.212","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.151","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.81","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.21","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.9","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/rtnetlink.c"]}],"references":["https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f","https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125","https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31","https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9","https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7","https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425","https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874","https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/27xxx/CVE-2024-27414.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-27414","state":"PUBLISHED","datePublished":"2024-05-17T11:50:57.207Z","dateUpdated":"2026-08-05T11:29:43.204Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-25T13:47:42.682Z"},"containers":{"cna":{"title":"rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back\n\nIn the commit d73ef2d69c0d (\"rtnetlink: let rtnl_bridge_setlink checks\nIFLA_BRIDGE_MODE length\"), an adjustment was made to the old loop logic\nin the function `rtnl_bridge_setlink` to enable the loop to also check\nthe length of the IFLA_BRIDGE_MODE attribute. However, this adjustment\nremoved the `break` statement and led to an error logic of the flags\nwriting back at the end of this function.\n\nif (have_flags)\n    memcpy(nla_data(attr), &flags, sizeof(flags));\n    // attr should point to IFLA_BRIDGE_FLAGS NLA !!!\n\nBefore the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS.\nHowever, this is not necessarily true fow now as the updated loop will let\nthe attr point to the last NLA, even an invalid NLA which could cause\noverflow writes.\n\nThis patch introduces a new variable `br_flag` to save the NLA pointer\nthat points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned\nerror logic."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ad46d4861ed36315d3d9e838723ba3e367ecc042","status":"affected","lessThan":"b9fbc44159dfc3e9a7073032752d9e03f5194a6f","versionType":"git"},{"version":"abb0172fa8dc4a4ec51aa992b7269ed65959f310","status":"affected","lessThan":"882a51a10ecf24ce135d573afa0872aef02c5125","versionType":"git"},{"version":"047508edd602921ee8bb0f2aa2100aa2e9bedc75","status":"affected","lessThan":"a1227b27fcccc99dc44f912b479e01a17e2d7d31","versionType":"git"},{"version":"8dfac8071d58447e5cace4c4c6fe493ce2f615f6","status":"affected","lessThan":"f2261eb994aa5757c1da046b78e3229a3ece0ad9","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"167d8642daa6a44b51de17f8ff0f584e1e762db7","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"831bc2728fb48a8957a824cba8c264b30dca1425","versionType":"git"},{"version":"d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f","status":"affected","lessThan":"743ad091fb46e622f1b690385bb15e3cd3daf874","versionType":"git"},{"version":"00757f58e37b2d9a6f99e15be484712390cd2bab","status":"affected","versionType":"git"},{"version":"5.4.253","status":"affected","lessThan":"5.4.271","versionType":"semver"},{"version":"5.10.190","status":"affected","lessThan":"5.10.212","versionType":"semver"},{"version":"5.15.126","status":"affected","lessThan":"5.15.151","versionType":"semver"},{"version":"6.1.45","status":"affected","lessThan":"6.1.81","versionType":"semver"},{"version":"6.4.10","status":"affected","lessThan":"6.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/rtnetlink.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"5.4.271","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.212","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.151","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.81","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.21","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.9","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/rtnetlink.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f"},{"url":"https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125"},{"url":"https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31"},{"url":"https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9"},{"url":"https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7"},{"url":"https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425"},{"url":"https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached via an RTM_SETLINK rtnetlink message over an AF_NETLINK socket, a local kernel interface with no remote or adjacent-network exposure.\nAC:L - The attacker fully controls the netlink message and its nested IFLA_AF_SPEC attributes, so crafting the layout that makes the final attr point out of bounds and triggering the memcpy write is fully reliable.\nPR:L - RTM_SETLINK requires CAP_NET_ADMIN checked against the net namespace's user_ns (netlink_net_capable), which an unprivileged user obtains via unshare -Urn.\nUI:N - The attacker triggers the flaw entirely by sending its own netlink message; no action by any other user is required.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same kernel security authority; no VM/sandbox/IOMMU boundary is crossed.\nC:H - The out-of-bounds heap write is memory corruption adjacent to the netlink buffer that can be leveraged to corrupt neighboring structures (length/pointer fields) toward information disclosure.\nI:H - This is a controlled out-of-bounds heap write (memory corruption), which under kernel guidance maps to High integrity impact.\nA:H - An out-of-bounds write into kernel heap memory can corrupt adjacent objects and cause an oops/panic, giving High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:29:43.204Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.253","versionEndExcluding":"5.4.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.190","versionEndExcluding":"5.10.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.126","versionEndExcluding":"5.15.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.45","versionEndExcluding":"6.1.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-27414","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-21T15:56:59.979228Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:46:58.154Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:34:52.359Z"}}]}}}