PT-2024-4116 · Linux+6 · Linux Kernel+6
Jianbo Liu
·
Published
2024-04-11
·
Updated
2025-09-29
·
CVE-2024-27018
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.8.0
Description
The vulnerability is related to the netfilter component of the Linux kernel, specifically the br netfilter module. It occurs when the bridge device is in promiscuous mode and packets directed to the taps follow the bridge input hook path. This can lead to a situation where cloned packets reach the br netfilter input hook, confirming the conntrack object. The issue is resolved by adding a workaround to reset conntrack for these packets and annotating the packet with a bit from BR INPUT SKB CB to indicate it has reached the input hook.
Recommendations
To resolve the issue, update the Linux kernel to version 6.8.0 or later. If updating is not possible, consider disabling the br netfilter module or restricting its use as a temporary workaround until a patch is available.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu