CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftlimit: reject configurations that cause integer overflow
Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s.
Its better to reject this rather than having incorrect ratelimit.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftlimit: reject configurations that cause integer overflow
The Linux kernel CVE team has assigned CVE-2024-26668 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040235-CVE-2024-26668-636e@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26668?
CVE-2024-26668 has a medium severity rating due to its potential impact on large packet handling in the Linux kernel.
How do I fix CVE-2024-26668?
To fix CVE-2024-26668, update to kernel versions 5.15.149, 6.1.76, 6.6.15, 6.7.3, 6.8 for Red Hat or suitable versions for Debian as specified.
Which systems are affected by CVE-2024-26668?
CVE-2024-26668 affects various Linux kernel versions for Red Hat and Debian systems, particularly those with specific ranges of the packages.
What exploits are associated with CVE-2024-26668?
CVE-2024-26668 can potentially be exploited in environments where large requests lead to integer overflows in netfilter configurations.
Is CVE-2024-26668 a critical vulnerability?
CVE-2024-26668 is not categorized as critical, but it should be addressed to prevent issues with high traffic scenarios.