CVE-2024-26673: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: sanitize layer 3 and 4 protocol number in custom expectations
- Disallow families other than NFPROTO{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for this object.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: sanitize layer 3 and 4 protocol number in custom expectations
The Linux kernel CVE team has assigned CVE-2024-26673 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040212-CVE-2024-26673-b2d3@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26673?
CVE-2024-26673 is classified as a high-severity vulnerability in the Linux kernel affecting netfilter.
How do I fix CVE-2024-26673?
To resolve CVE-2024-26673, update to the latest kernel version: 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8, or the specific patched Debian kernel versions.
Which Linux kernel versions are affected by CVE-2024-26673?
CVE-2024-26673 affects various versions of the Linux kernel prior to the specified fixed versions, including those below 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, and 6.7.4.
What does CVE-2024-26673 affect in the Linux kernel?
CVE-2024-26673 affects the netfilter component, specifically issues related to sanitizing layer 3 and 4 protocol numbers.
Is CVE-2024-26673 remotely exploitable?
Yes, CVE-2024-26673 could potentially be exploited remotely due to its implications on network traffic through the netfilter component.