huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-35864: kernel: smb: client: fix potential UAF in smb2_is_valid_lease_break()
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel in smb smb2_is_valid_lease_break() when exiting a session. This flaw allows a local attacker to crash the system.


Affected upstream versions: 3.12.48 < 3.13, 3.13
Fixed upstream versions: 0, 3.13, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c868cabdf6fdd61bea54532271f4708254e57fc5
CVE-2024-35865: kernel: smb: client: fix potential UAF in smb2_is_valid_oplock_break()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_valid_oplock_break()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.


Affected upstream versions: 3.12.48 < 3.13, 3.13
Fixed upstream versions: 0, 3.13, 5.15.209, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a710ef9e974f18232d2b9b19c90eda1a1167b2d4
CVE-2024-35866: kernel: smb: client: fix potential UAF in cifs_dump_full_key()
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel in the smb client cifs_dump_full_key() when exiting a session. This flaw allows a local attacker to crash the system.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.181, 6.1.132, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d798fd98e3563027c5162259ead517057d6fa794
CVE-2024-35867: kernel: smb: client: fix potential UAF in cifs_stats_proc_show()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_show()

The Linux kernel CVE team has assigned CVE-2024-35867 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051939-CVE-2024-35867-15e3@gregkh/T


Affected upstream versions: 3.12.48 < 3.13, 3.13
Fixed upstream versions: 0, 3.13, 5.10.237, 5.15.181, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 838ec01ea8d3deb5d123e8ed9022e8162dc3f503
CVE-2024-35868: kernel: smb: client: fix potential UAF in cifs_stats_proc_write()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_write()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.


Affected upstream versions: 3.12.48 < 3.13, 3.13
Fixed upstream versions: 0, 3.13, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8fefd166fcb368c5fcf48238e3f7c8af829e0a72
CVE-2024-35869: kernel: smb: client: guarantee refcounted children from parent session
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

The following vulnerability has been resolved in the Linux kernel: smb: client: Fix - Guarantee refcounted children from the parent session.


Affected upstream versions: 6.2.15 < 6.3, 6.3.2 < 6.4, 6.4
Fixed upstream versions: 0, 6.3, 6.4, 6.6.29, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 645f332c6b63499cc76197f9b6bffcc659ba64cc
CVE-2024-35870: kernel: smb: client: fix UAF in smb2_reconnect_server()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.9 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-05-19T00:00:00+00:00

A flaw was found in the smb client in the Linux kernel. A potential use-after-free error was seen in the smb2_reconnect_server() function. This issue can lead to the crash of a client user session.

Statement: This vulnerability considered being Moderate impact because of limitations for attack scenario.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 6.1.121, 6.6.29, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 755fe68cd4b59e1d2a2dd3286177fd4404f57fed
CVE-2024-35872: kernel: mm/secretmem: fix GUP-fast succeeding on secretmem folios
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/secretmem: fix GUP-fast succeeding on secretmem folios

The Linux kernel CVE team has assigned CVE-2024-35872 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051941-CVE-2024-35872-4632@gregkh/T


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6564b014af92b677c1f07c44d7f5b595d589cf6e
CVE-2024-35875: kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35875 addresses a security concern in the Linux kernel's handling of confidential computing (CoCo) environments. In these setups, the virtual machine (VM) host is untrusted and may attempt to compromise guest VMs. A critical component for maintaining security in such environments is a reliable random number generator (RNG), which depends on the CPU's RDRAND instruction to generate entropy.

The vulnerability arises when the RDRAND instruction fails—due to hardware faults or other issues—leaving the RNG without sufficient entropy sources. This deficiency is particularly problematic during the system's initial boot phase, potentially compromising cryptographic operations and overall system security.

In CoCo environments, the untrusted VM host can manipulate or observe most inputs to guest VMs. The primary entropy source for these guests is the CPU's RDRAND instruction. If RDRAND fails, the RNG lacks alternative entropy sources, leading to potential security vulnerabilities.

A malfunctioning RDRAND during boot can result in insufficient entropy for cryptographic functions, undermining the security of the CoCo environment.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374
CVE-2024-35877: kernel: x86/mm/pat: fix VM_PAT handling in COW mappings
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35877 pertains to a flaw in the Linux kernel's handling of Page Attribute Table (PAT) settings during Copy-On-Write (COW) operations. When a write operation triggers a COW event, the kernel may replace the original page table entries (PTEs) with anonymous folios. This replacement disrupts the kernel's ability to accurately retrieve the correct page frame number (PFN) and cache mode using the follow_phys() function. Consequently, this mismanagement can lead to memory leaks or system instability.

During COW operations, the kernel's PAT handling may incorrectly replace PTEs, leading to failures in functions like untrack_pfn() and track_pfn_copy(). This mismanagement can result in improper memory tracking and potential leaks.

Systems may experience memory leaks or instability due to the kernel's inability to correctly manage memory attributes during COW events.


Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.155, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f18681daaec9665a15c5e7e0f591aad5d0ac622b
CVE-2024-35878: kernel: of: module: prevent NULL pointer dereference in vsnprintf()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A null pointer dereference vulnerability was found in vsnprintf when str and len parameters are passed to vsnprintf(), which only allows passing a NULL ptr
when the length is 0. This issue can result in a crash and damage to availability.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4a449368a2ce6d57a775d0ead27fc07f5a86e5b
CVE-2024-35880: kernel: io_uring/kbuf: hold io_buffer_list reference over mmap
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35880 is a vulnerability in the Linux kernel's io_uring subsystem, specifically related to how kernel buffers (kbuf) are handled during memory mapping (mmap) operations. The flaw stems from a situation where a buffer can be unregistered prematurely while it is still being used, leading to a potential use-after-free issue.

The io_uring mechanism uses the Read-Copy-Update (RCU) method to manage buffers during mmap. However, the absence of a strong reference to the buffer during operations allows it to be unregistered while still in use.

This can result in memory dereferencing errors, leading to crashes or unpredictable behavior.


Affected upstream versions: 6.6.5 < 6.6.26, 6.7
Fixed upstream versions: 0, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65938e81df2197203bda4b9a0c477e7987218d66
CVE-2024-35884: kernel: udp: do not accept non-tunnel GSO skbs landing in a tunnel
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35884 highlights a flaw in the Linux kernel's handling of UDP packets when Generic Receive Offload (GRO) forwarding is enabled. The issue occurs because non-tunnel UDP packets are sometimes mistakenly processed as if they belong to a tunnel. This can lead to data corruption or kernel crashes, particularly in environments with complex network configurations or when certain tunneling protocols like Geneve are used.

The kernel's processing logic for GRO and UDP packets fails to properly differentiate between tunneled and non-tunneled packets. As a result, improperly handled packets may lead to segmentation errors or system instability.

This vulnerability affects system availability and could result in crashes or data integrity issues during packet forwarding.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3391b157780bbedf8ef9f202cbf10ee90bf6b0f8
CVE-2024-35885: kernel: mlxbf_gige: stop interface during shutdown
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mlxbf_gige: stop interface during shutdown

The Linux kernel CVE team has assigned CVE-2024-35885 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051946-CVE-2024-35885-ce9c@gregkh/T


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 63a10b530e22cc923008b5925821c26872f37971
CVE-2024-35886: kernel: ipv6: Fix infinite recursion in fib6_dump_done().
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix infinite recursion in fib6_dump_done().

The Linux kernel CVE team has assigned CVE-2024-35886 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051946-CVE-2024-35886-19d4@gregkh/T


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9472d07cd095cbd3294ac54c42f304a38fbe9bfe
CVE-2024-35888: kernel: erspan: make sure erspan_base_hdr is present in skb-&gt;head
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

erspan: make sure erspan_base_hdr is present in skb-&gt;head

The Linux kernel CVE team has assigned CVE-2024-35888 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051947-CVE-2024-35888-1e04@gregkh/T


Affected upstream versions: 4.19.20 < 4.19.312, 4.20.7 < 4.21, 5.0
Fixed upstream versions: 0, 4.19.312, 4.21, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06a939f72a24a7d8251f84cf4c042df86c6666ac
CVE-2024-35890: kernel: gro: fix ownership transfer
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) feature, where packets processed with a fragment list are not properly orphaned due to incorrect handling of socket references. This vulnerability can cause system instability or kernel bugs. The issue has been fixed by making sure that socket references are correctly removed during packet processing. Users should update their kernel to the patched version to mitigate this risk.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d225b0ac96dc40d7e8ae2bc227eb2c56e130975f
CVE-2024-35891: kernel: net: phy: micrel: Fix potential null pointer dereference
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: phy: micrel: Fix potential null pointer dereference

In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may
return NULL as ptp_header due to abnormal packet type or corrupted packet.
Fix this bug by adding ptp_header check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 10608161696c2768f53426642f78a42bcaaa53e8
CVE-2024-35892: kernel: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35892 is a vulnerability in the Linux kernel’s network scheduler caused by improper use of the qdisc_lookup() function. This function assumes the global RTNL lock is held, but in the qdisc_tree_reduce_backlog() function, only a local queue lock is used. This mismatch creates a race condition that could lead to system instability or crashes. The issue has been fixed by replacing qdisc_lookup() with an RCU-safe version that works correctly in this context.


Affected upstream versions: 6.1.34 < 6.1.85, 6.3.8 < 6.4, 6.4
Fixed upstream versions: 0, 6.1.85, 6.4, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b7d1ce2cc7192e8a037faa3f5d3ba72c25976460
CVE-2024-35894: kernel: mptcp: prevent BPF accessing lowat from a subflow socket.
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mptcp: prevent BPF accessing lowat from a subflow socket.

Alexei reported the following splat:

 WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0
 Modules linked in: dummy bpf_testmod(O) [last unloaded: bpf_test_no_cfi(O)]
 CPU: 32 PID: 3276 Comm: test_progs Tainted: GO       6.8.0-12873-g2c43c33bfd23
 Call Trace:
  <TASK>
  mptcp_set_rcvlowat+0x79/0x1d0
  sk_setsockopt+0x6c0/0x1540
  __bpf_setsockopt+0x6f/0x90
  bpf_sock_ops_setsockopt+0x3c/0x90
  bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b
  bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b/0x132
  bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86
  __cgroup_bpf_run_filter_sock_ops+0xbc/0x250
  tcp_connect+0x879/0x1160
  tcp_v6_connect+0x50c/0x870
  mptcp_connect+0x129/0x280
  __inet_stream_connect+0xce/0x370
  inet_stream_connect+0x36/0x50
  bpf_trampoline_6442491565+0x49/0xef
  inet_stream_connect+0x5/0x50
  __sys_connect+0x63/0x90
  __x64_sys_connect+0x14/0x20

The root cause of the issue is that bpf allows accessing mptcp-level
proto_ops from a tcp subflow scope.

Fix the issue detecting the problematic call and preventing any action.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ee3c845787b621cfe82c2e52c513024a9d7a78f5
CVE-2024-35895: kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35895 addresses a vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, specifically within the sockmap feature. The issue arises when BPF tracing programs, which can execute in various interrupt contexts, attempt to delete elements from sockmap or sockhash maps. This operation involves acquiring locks that are not safe for use in hard interrupt contexts, leading to potential deadlocks due to lock inversion.

BPF tracing programs may delete elements from sockmap/sockhash maps while running in interrupt contexts where the required locks are not hardirq-safe, causing possible deadlocks.

System hangs or crashes due to deadlocks when deleting elements from sockmap/sockhash maps in inappropriate contexts.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f7990498b05ac41f7d6a190dc0418ef1d21bf058
CVE-2024-35896: kernel: netfilter: validate user input for expected length
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35896 is a vulnerability in the Linux kernel's Netfilter component, where the setsockopt function fails to properly validate the length of user-supplied data before copying it into kernel space. This oversight can lead to out-of-bounds memory access, potentially causing system crashes or allowing attackers to execute arbitrary code. The issue has been addressed by implementing appropriate checks on the optlen argument to ensure data is correctly sized before being processed. Users are advised to update their Linux kernel to a version that includes this fix to mitigate potential risks.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f038242b77ddfc505bf4163d4904c1abd2e74d6
CVE-2024-35897: kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

This CVE involves a flaw in the Linux kernel's nf_tables component, part of the Netfilter framework used for packet filtering and firewall functionalities. The vulnerability arises when a table's dormant flag is updated while there's a pending deletion of a base chain. In such cases, the unregistration of hooks is deferred until the commit phase. If both operations—updating the dormant flag and deleting the base chain—are combined, it can result in the base chain being deleted while its hook remains registered in the core system. This inconsistency may lead to unexpected behavior or potential security risks.


Affected upstream versions: 5.4.262 < 5.4.274, 5.10.202 < 5.10.215, 5.13
Fixed upstream versions: 0, 5.10.215, 5.15.155, 5.4.274, 6.1.86, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e75faf01e22ec7dc671640fa0e0968964fafd2fc
CVE-2024-35898: kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

The Linux kernel CVE team has assigned CVE-2024-35898 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051951-CVE-2024-35898-a10e@gregkh/T


Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 69d1fe14a680042ec913f22196b58e2c8ff1b007
CVE-2024-35899: kernel: netfilter: nf_tables: flush pending destroy work before exit_net release
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A vulnerability was found in the Linux kernel's Netfilter framework, specifically within the nf_tables component. The issue arises from a race condition between the exit_net function and the destroy work queue, which can lead to use-after-free errors and potential system instability. This vulnerability has been addressed by making sure that any pending destroy work is flushed before releasing network namespaces, thereby preventing the race condition. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability and security.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f4e14695fe805eb0f0cb36e0ad6a560b9f985e86