| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject QUEUE/DROP verdict parameters\n\nThis reverts commit e0abdadcc6e1.\n\ncore.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP\nverdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar,\nor 0.\n\nDue to the reverted commit, its possible to provide a positive\nvalue, e.g. NF_ACCEPT (1), which results in use-after-free.\n\nIts not clear to me why this commit was made.\n\nNF_QUEUE is not used by nftables; \"queue\" rules in nftables\nwill result in use of \"nft_queue\" expression.\n\nIf we later need to allow specifiying errno values from userspace\n(do not know why), this has to call NF_DROP_GETERR and check that\n\"err <= 0\" holds true." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "versions": [ |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "8365e9d92b85", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "4e66422f1b56", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "55a60251fa50", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "960cf4f81253", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "8e34430e33b8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "6653118b176a", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "f05a497e7bc8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e0abdadcc6e1", |
| "lessThan": "f342de4e2f33", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "versions": [ |
| { |
| "version": "3.15", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "3.15", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.19.307", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.4.269", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.10.210", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.15.149", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "6.1.76", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "6.6.15", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "6.7.3", |
| "lessThanOrEqual": "6.7.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "6.8", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/8365e9d92b85fda975a5ece7a3a139cb964018c8" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4e66422f1b56149761dc76030e6345d1cca6f869" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/55a60251fa50d4e68175e36666b536a602ce4f6c" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/960cf4f812530f01f6acc6878ceaa5404c06af7b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/8e34430e33b8a80bc014f3efe29cac76bc30a4b4" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/6653118b176a00915125521c6572ae8e507621db" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/f05a497e7bc8851eeeb3a58da180ba469efebb05" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/f342de4e2f33e0e39165d8639387aa6c19dff660" |
| } |
| ], |
| "title": "netfilter: nf_tables: reject QUEUE/DROP verdict parameters", |
| "x_generator": { |
| "engine": "bippy-8df59b4913de" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-26609", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
