CVE-2024-26643: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: mark set as dead when unbinding anonymous set with timeout
The Linux kernel CVE team has assigned CVE-2024-26643 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024032150-CVE-2024-26643-4f9d@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: mark set as dead when unbinding anonymous set with timeout
While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nftables: use timestamp to check for set element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.
According to 08e4c8c5919f ("netfilter: nftables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26643?
CVE-2024-26643 has been assigned a severity rating that indicates a potential impact on the Linux kernel's netfilter functionality.
How do I fix CVE-2024-26643?
To fix CVE-2024-26643, upgrade to the latest kernel version as specified by your Linux distribution.
Which Linux kernel versions are affected by CVE-2024-26643?
CVE-2024-26643 affects specific versions of the Linux kernel, including those prior to the fixes in versions 6.8 and various patches in the 5.10 and 6.1 series.
Is there a workaround for CVE-2024-26643?
Currently, there is no known workaround for CVE-2024-26643; updates to the kernel are recommended to mitigate the vulnerability.
What components of the Linux kernel are impacted by CVE-2024-26643?
CVE-2024-26643 primarily impacts the netfilter component of the Linux kernel, related to functionality around anonymous sets with timeouts.