CVE-2024-0607: Kernel: nf_tables: pointer math issue in nft_byteorder_eval()
A flaw was found in the Netfilter module in the Linux kernel. The problem is in the nftbyteordereval() function where the code is iterating through a loop and writing to dst[0], dst[1], dst[2] and so on. On each iteration 8 bytes get written, but dst[] is an array of u32 so each element only has space for 4 bytes. That means that every iteration overwrites part of the previous element.
Upstream commit: https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63
Other sources
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nftbyteordereval() function, where the code iterates through a loop and writes to the dst array. On each iteration, 8 bytes are written, but dst is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
— Launchpad
Kernel: nftables: pointer math issue in nftbyteordereval()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.64-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.5.13-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 with sysctl -w; persist the setting across reboots in /etc/sysctl.d/99-disable-unpriv-userns.conf.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0607?
CVE-2024-0607 has a critical severity rating due to its potential to cause kernel crashes or data corruption.
How do I fix CVE-2024-0607?
To fix CVE-2024-0607, update the kernel to version 6.7 or apply the specific patches provided by your distribution.
What versions of the Linux kernel are affected by CVE-2024-0607?
CVE-2024-0607 affects Linux kernel versions prior to 6.7, including certain versions of Debian and Red Hat Enterprise Linux.
Is CVE-2024-0607 related to a specific Linux distribution?
Yes, CVE-2024-0607 impacts multiple distributions such as Red Hat Enterprise Linux, Debian, and Fedora.
What components of the Linux kernel are impacted by CVE-2024-0607?
CVE-2024-0607 specifically affects the Netfilter module due to a flaw in the nft_byteorder_eval() function.