Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2024-35900

netfilter: nf_tables: reject new basechain after table flag update

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y { type filter hook input priority 0; } add table x { flags dormant; } add chain x w { type filter hook input priority 1; } which triggers the following warning when trying to unregister chain w which is already unregistered. [ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] <TASK> [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3 to < 6d12f21f8bbe23fde25b77c2bf5973c136b8bef8affected
  • e10f661adc556c4969c70ddaddf238bffdaf1e87 to < 41bad13c0e8a5a2b47a7472cced922555372daabaffected
  • d9c4da8cb74e8ee6e58a064a3573aa37acf6c935 to < 7b6fba6918714afee3e17796113ccab636255c7baffected
  • 179d9ba5559a756f4322583388b3213fe4e391b0 to < 8ba81dca416adf82fc5a2a23abc1a8cc02ad32fbaffected
  • 179d9ba5559a756f4322583388b3213fe4e391b0 to < 745cf6a843896cdac8766c74379300ed73c78830affected
  • 179d9ba5559a756f4322583388b3213fe4e391b0 to < 420132bee3d0136b7fba253a597b098fe15493a7affected
  • 179d9ba5559a756f4322583388b3213fe4e391b0 to < e95bb4cba94c018be24b11f017d1c55dd6cda31aaffected
  • 179d9ba5559a756f4322583388b3213fe4e391b0 to < 994209ddf4f430946f6247616b2e33d179243769affected
  • 5.4.262 to < 5.4.274affected
  • 5.10.202 to < 5.10.215affected

Linux Linux

Default version status: affected

  • 5.13affected
  • 0 to < 5.13unaffected
  • 5.4.274 to ≤ 5.4.*unaffected
  • 5.10.215 to ≤ 5.10.*unaffected
  • 5.15.154 to ≤ 5.15.*unaffected
  • 6.1.85 to ≤ 6.1.*unaffected
  • 6.6.26 to ≤ 6.6.*unaffected
  • 6.8.5 to ≤ 6.8.*unaffected
  • 6.9 to ≤ *unaffected

References