CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: Fix potential data-race in nftexprtypeget()
nftunregisterexpr() can concurrent with nftexprtypeget(), and there is not any protection when iterate over nftablesexpressions list in nftexprtypeget(). Therefore, there is potential data-race of nftablesexpressions list entry.
Use listforeachentryrcu() to iterate over nftablesexpressions list in nftexprtypeget(), and use rcureadlock() in the caller nftexprtypeget() to protect the entire type query process.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: Fix potential data-race in nftexprtypeget()
The Linux kernel CVE team has assigned CVE-2024-27020 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27020-5158@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by potential data-race in nftexprtypeget() in netfilter: nftables. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.157 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.88 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.29 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Compensating control
Apply the upstream netfilter/nf_tables fix for CVE-2024-27020 by updating the iteration over the nf_tables_expressions list in __nft_expr_type_get() to use list_for_each_entry_rcu() and ensure rcu_read_lock() protects the entire type query process (as described in the upstream advisory).
- Compensating control
Ensure __nft_expr_type_get() performs the nf_tables_expressions iteration with RCU protection (list_for_each_entry_rcu()) so that it is safe if nft_unregister_expr() runs concurrently.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27020?
CVE-2024-27020 has been classified as a medium severity vulnerability due to the potential data race condition in the Linux kernel.
How do I fix CVE-2024-27020?
To fix CVE-2024-27020, update your kernel to versions 5.15.157, 6.1.88, or later versions as specified in the security advisories.
What versions of the Linux kernel are affected by CVE-2024-27020?
CVE-2024-27020 affects various versions of the Linux kernel from 3.13 up to 6.9-rc4, depending on the specific distribution and version.
Who reported the vulnerability CVE-2024-27020?
CVE-2024-27020 was reported as a potential data race condition in the kernel netfilter component.
Is there a workaround for CVE-2024-27020?
Currently, there is no known workaround for CVE-2024-27020, making it essential to apply the recommended kernel updates.