PT-2024-36945 · Linux+6 · Linux Kernel+6
Phil Sutter
·
Published
2024-11-29
·
Updated
2025-10-07
·
CVE-2024-56637
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A race condition in the Linux kernel's netfilter: ipset module can lead to a kernel crash. This occurs when user space unloads the ip set.ko module while it is requesting a set type backend module. The issue can be provoked by inserting a delay after the nfnl unlock() call.
Recommendations
For versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider disabling the
ip set.ko module until a patch is available. Restrict access to the vulnerable netfilter: ipset module to minimize the risk of exploitation. Avoid using the nfnl unlock() function in conjunction with mdelay() until the issue is resolved.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu