Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts. The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
55a60251fa50d4e68175e36666b536a602ce4f6c to < 2f7f825a548be55420f0f5f716f6c27b9d312d3faffected960cf4f812530f01f6acc6878ceaa5404c06af7b to < f140593901724cfbd16597c3a4fcb24a58ae44b0affected8e34430e33b8a80bc014f3efe29cac76bc30a4b4 to < 68390437a998c3f2c57212b413abef5e6d657d88affected6653118b176a00915125521c6572ae8e507621db to < 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2affectedf342de4e2f33e0e39165d8639387aa6c19dff660 to < f710691be163ae6b39e4bcab9e5be32d329f035baffectedf342de4e2f33e0e39165d8639387aa6c19dff660 to < 42a47f4b1b7695026ab9bc1bb35d4622b0835c95affectedf342de4e2f33e0e39165d8639387aa6c19dff660 to < 17dc5d5a935c771338430cbc156a16a51cfd31e8affectedf342de4e2f33e0e39165d8639387aa6c19dff660 to < da107398cbd4bbdb6bffecb2ce86d5c9384f4cecaffected8365e9d92b85fda975a5ece7a3a139cb964018c8affected4e66422f1b56149761dc76030e6345d1cca6f869affectedf05a497e7bc8851eeeb3a58da180ba469efebb05affected5.10.210 to < 5.10.253affected5.15.149 to < 5.15.203affected6.1.76 to < 6.1.168affected6.6.15 to < 6.6.134affected4.19.307 to < 4.20affected5.4.269 to < 5.5affected6.7.3 to < 6.8affected
Linux Linux
Default version status: affected
6.8affected0 to < 6.8unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2f7f825a548be55420f0f5f716f6c27b9d312d3f ↗
- https://git.kernel.org/stable/c/f140593901724cfbd16597c3a4fcb24a58ae44b0 ↗
- https://git.kernel.org/stable/c/68390437a998c3f2c57212b413abef5e6d657d88 ↗
- https://git.kernel.org/stable/c/4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 ↗
- https://git.kernel.org/stable/c/f710691be163ae6b39e4bcab9e5be32d329f035b ↗
- https://git.kernel.org/stable/c/42a47f4b1b7695026ab9bc1bb35d4622b0835c95 ↗
- https://git.kernel.org/stable/c/17dc5d5a935c771338430cbc156a16a51cfd31e8 ↗
- https://git.kernel.org/stable/c/da107398cbd4bbdb6bffecb2ce86d5c9384f4cec ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗