CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftsetpipapo: walk over current view on netlink dump
The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set.
Based on patch from Florian Westphal.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftsetpipapo: walk over current view on netlink dump
The Linux kernel CVE team has assigned CVE-2024-27017 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27017-d867@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27017?
CVE-2024-27017 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27017?
To fix CVE-2024-27017, please update your kernel to at least version 6.8.8 or apply the appropriate patches for the affected distributions.
Which Linux distributions are affected by CVE-2024-27017?
CVE-2024-27017 affects several Linux distributions including Red Hat, Debian, and Fedora.
What component of the Linux kernel does CVE-2024-27017 involve?
CVE-2024-27017 involves the netfilter component specifically related to the pipapo set backend walk iterator.
Is there a workaround for CVE-2024-27017?
There is no known workaround for CVE-2024-27017, so updating the kernel is the recommended action.