CVE-2024-26642 — Resource Injection in Linux

CWE-99 — Resource Injection52 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8OSV7.0
EPSS
0.0%
top 98.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedMar 21
Latest updateSep 18

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinux/linux_kernel4.1 — 4.19.312+6
▶Debianlinux/linux_kernel< 5.10.216-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-189.209+6
▶CVEListV5linux/linux761da2935d6e18d178582dbdf315a3a458555505 — e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9+8
▶debiandebian/linux< linux 6.1.85-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

25
OSV
linux-xilinx-zynqmp vulnerabilities↗2024-09-18
▶
OSV
linux-oem-6.5 vulnerabilities↗2024-08-02
▶
OSV
linux-gcp-5.15 vulnerabilities↗2024-07-30
▶
OSV
linux-raspi vulnerabilities↗2024-07-26
▶
OSV
linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities↗2024-07-26
▶

📋Vendor Advisories

25
Ubuntu
Linux kernel vulnerabilities↗2024-09-18
▶
Ubuntu
Linux kernel vulnerabilities↗2024-08-02
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-30
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-26
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-26
▶

💬Community

1
Bugzilla
CVE-2024-26642 kernel: netfilter: nf_tables: disallow anonymous set with timeout flag↗2024-03-21
▶