CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump
First published: Wed May 01 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set. Based on patch from Florian Westphal.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <6.8.8 | 6.8.8 |
| redhat/kernel | <6.9 | 6.9 |
| Linux kernel | >=6.4<6.8.8 | |
| Linux kernel | =6.9-rc1 | |
| Linux kernel | =6.9-rc2 | |
| Linux kernel | =6.9-rc3 | |
| Linux kernel | =6.9-rc4 | |
| Fedora | =38 | |
| Fedora | =39 | |
| Fedora | =40 | |
| debian/linux | <=5.10.223-1 | 5.10.234-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.16-1 |
| debian/linux-6.1 | 6.1.128-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73
- https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed
- https://launchpad.net/bugs/cve/CVE-2024-27017
- https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786
- https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679
- https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650
- https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27017
- https://nvd.nist.gov/vuln/detail/CVE-2024-27017
- https://security-tracker.debian.org/tracker/CVE-2024-27017
- https://ubuntu.com/security/CVE-2024-27017
- https://git.kernel.org/linus/29b359cf6d95fd60730533f7f10464e95bd17c73
- https://access.redhat.com/security/cve/CVE-2024-27017
- https://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27017-d867@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2278263
- https://access.redhat.com/errata/RHSA-2024:8870
- https://access.redhat.com/errata/RHSA-2024:8856
- https://access.redhat.com/errata/RHSA-2024:9315
- https://access.redhat.com/errata/RHSA-2025:1658
- https://bugzilla.redhat.com/show_bug.cgi?id=2278262
Frequently Asked Questions
What is the severity of CVE-2024-27017?
CVE-2024-27017 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27017?
To fix CVE-2024-27017, please update your kernel to at least version 6.8.8 or apply the appropriate patches for the affected distributions.
Which Linux distributions are affected by CVE-2024-27017?
CVE-2024-27017 affects several Linux distributions including Red Hat, Debian, and Fedora.
What component of the Linux kernel does CVE-2024-27017 involve?
CVE-2024-27017 involves the netfilter component specifically related to the pipapo set backend walk iterator.
Is there a workaround for CVE-2024-27017?
There is no known workaround for CVE-2024-27017, so updating the kernel is the recommended action.
- agent/title
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/usn-cve
- source/Ubuntu
- agent/last-modified-date
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-27017
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.4
- version/linux kernel/6.9-rc1
- version/linux kernel/6.9-rc2
- version/linux kernel/6.9-rc3
- version/linux kernel/6.9-rc4
- vendor/fedoraproject
- canonical/fedora
- version/fedora/38
- version/fedora/39
- version/fedora/40
- package-manager/debian