CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: Fix potential data-race in nftexprtypeget()
nftunregisterexpr() can concurrent with nftexprtypeget(), and there is not any protection when iterate over nftablesexpressions list in nftexprtypeget(). Therefore, there is potential data-race of nftablesexpressions list entry.
Use listforeachentryrcu() to iterate over nftablesexpressions list in nftexprtypeget(), and use rcureadlock() in the caller nftexprtypeget() to protect the entire type query process.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: Fix potential data-race in nftexprtypeget()
The Linux kernel CVE team has assigned CVE-2024-27020 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27020-5158@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by potential data-race in nftexprtypeget() in netfilter: nftables. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27020?
CVE-2024-27020 has been classified as a medium severity vulnerability due to the potential data race condition in the Linux kernel.
How do I fix CVE-2024-27020?
To fix CVE-2024-27020, update your kernel to versions 5.15.157, 6.1.88, or later versions as specified in the security advisories.
What versions of the Linux kernel are affected by CVE-2024-27020?
CVE-2024-27020 affects various versions of the Linux kernel from 3.13 up to 6.9-rc4, depending on the specific distribution and version.
Who reported the vulnerability CVE-2024-27020?
CVE-2024-27020 was reported as a potential data race condition in the kernel netfilter component.
Is there a workaround for CVE-2024-27020?
Currently, there is no known workaround for CVE-2024-27020, making it essential to apply the recommended kernel updates.