CVE-2024-27403: netfilter: nft_flow_offload: reset dst in route object after setting up flow
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftflowoffload: reset dst in route object after setting up flow
dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flowoffloadadd() fails, error path releases dst twice, leading to a refcount underflow.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftflowoffload: reset dst in route object after setting up flow
The Linux kernel CVE team has assigned CVE-2024-27403 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-27403-c4ba@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.150 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.80 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.19 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27403?
CVE-2024-27403 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-27403?
To address CVE-2024-27403, update your Linux kernel to the patched versions: 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8, or appropriate Debian versions.
Which Linux kernel versions are affected by CVE-2024-27403?
CVE-2024-27403 affects various versions of the Linux kernel prior to the mentioned patched releases.
Is CVE-2024-27403 applicable to all Linux distributions?
CVE-2024-27403 primarily impacts Red Hat and Debian distributions that use the specified vulnerable kernel versions.
What components are impacted by CVE-2024-27403?
CVE-2024-27403 specifically impacts the netfilter and nft_flow_offload components of the Linux kernel.