| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024041714-CVE-2024-26835-083d@gregkh> Date: Wed, 17 Apr 2024 12:10:17 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure Description =========== In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks. On table/base chain deletion, nf_tables will attempt to unregister the hook again which yields a warn splat from the nftables core. The Linux kernel CVE team has assigned CVE-2024-26835 to this issue. Affected and fixed versions =========================== Issue introduced in 5.4.262 with commit e10f661adc55 and fixed in 5.4.270 with commit ae4360cbd385 Issue introduced in 5.10.202 with commit d9c4da8cb74e and fixed in 5.10.211 with commit 31ea574aeca1 Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 5.15.150 with commit 664264a5c55b Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.1.80 with commit 0c9302a6da26 Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.6.19 with commit f2135bbf1494 Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.7.7 with commit 6f2496366426 Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.8 with commit bccebf647017 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26835 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/netfilter/nf_tables_api.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ae4360cbd385f0d7a8a86d5723e50448cc6318f3 https://git.kernel.org/stable/c/31ea574aeca1aa488e18716459bde057217637af https://git.kernel.org/stable/c/664264a5c55bf97a9c571c557d477b75416199be https://git.kernel.org/stable/c/0c9302a6da262e6ab6a6c1d30f04a6130ed97376 https://git.kernel.org/stable/c/f2135bbf14949687e96cabb13d8a91ae3deb9069 https://git.kernel.org/stable/c/6f2496366426cec18ba53f1c7f6c3ac307ca6a95 https://git.kernel.org/stable/c/bccebf64701735533c8db37773eeacc6566cc8ec
Powered by blists - more mailing lists