PT-2024-21616 · Linux+7 · Linux Kernel+7
Published
2024-04-17
·
Updated
2026-03-14
·
CVE-2024-27012
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The vulnerability is related to the netfilter subsystem in the Linux kernel, specifically in the nf tables module. The issue arises when the
nft mapelem activate() function needs to restore refcounters to their original state during the abort path. Currently, it uses the set->ops->walk() function to iterate over set elements, but the existing set iterator skips inactive elements in the next generation. This does not work from the abort path because it needs to skip active elements instead. The patch moves the check for inactive elements to the set iterator callback and reverses the logic for the .activate case to skip active elements. The vulnerability can cause a memory leak, as shown in the provided splat.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu