{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-27017", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.209Z", "datePublished": "2024-05-01T05:30:01.888Z", "dateUpdated": "2026-08-05T11:29:00.212Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:00.212Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\n\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\n\nBased on patch from Florian Westphal." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the nfnetlink/nftables netlink socket (NFT_MSG_GETSETELEM dump raced against transaction commit/abort), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - The attacker controls both sides of the race — one thread issues repeated set-element dumps while another repeatedly commits/aborts transactions to flip the gencursor and free priv->clone — and can retry indefinitely; once the wrong branch is latched the free window spans the entire element walk.\nPR:L - nfnetlink_rcv_msg() only requires CAP_NET_ADMIN via netlink_net_capable(), which an unprivileged user obtains in their own network namespace with `unshare -Urn`, where they can freely create pipapo sets and drive both the dump and the transaction.\nUI:N - Exploitation is entirely driven by the attacker's own netlink threads; no action by any other user or administrator is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority, giving kernel-level compromise rather than crossing a hypervisor, IOMMU, or other scope boundary.\nC:H - The walk reads element pointers and contents from freed memory and copies them straight into the netlink dump reply (nft_data_dump of key/data, plus nla_put of udata->len bytes at udata->data), giving a groomable arbitrary kernel-memory read exfiltrated directly to userspace.\nI:H - The element pointer `e` is taken from the freed mt array, so after heap reallocation the attacker controls it, and nf_tables_fill_expr_info() performs an indirect call via `expr->ops->dump()` on that object — a control-flow hijack primitive enabling privilege escalation.\nA:H - Even without successful exploitation, dereferencing freed/reallocated pipapo match data and wild element pointers produces an oops or panic, and the race can be re-triggered at will to crash the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c" ], "versions": [ { "version": "2a90da8e0dd50f42e577988f4219f4f4cd3616b7", "lessThan": "ff89db14c63a827066446460e39226c0688ef786", "status": "affected", "versionType": "git" }, { "version": "45eb6944d0f55102229115de040ef3a48841434a", "lessThan": "ce9fef54c5ec9912a0c9a47bac3195cc41b14679", "status": "affected", "versionType": "git" }, { "version": "0d836f917520300a8725a5dbdad4406438d0cead", "lessThan": "52735a010f37580b3a569a996f878fdd87425650", "status": "affected", "versionType": "git" }, { "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "f24d8abc2bb8cbf31ec713336e402eafa8f42f60", "status": "affected", "versionType": "git" }, { "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "721715655c72640567e8742567520c99801148ed", "status": "affected", "versionType": "git" }, { "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "29b359cf6d95fd60730533f7f10464e95bd17c73", "status": "affected", "versionType": "git" }, { "version": "f661383b5f1aaac3fe121b91e04332944bc90193", "status": "affected", "versionType": "git" }, { "version": "5.10.186", "lessThan": "5.10.227", "status": "affected", "versionType": "semver" }, { "version": "5.15.119", "lessThan": "5.15.168", "status": "affected", "versionType": "semver" }, { "version": "6.1.36", "lessThan": "6.1.112", "status": "affected", "versionType": "semver" }, { "version": "6.3.10", "lessThan": "6.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.112", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.53", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.186", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.119", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.36", "versionEndExcluding": "6.1.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786" }, { "url": "https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679" }, { "url": "https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650" }, { "url": "https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60" }, { "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed" }, { "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73" } ], "title": "netfilter: nft_set_pipapo: walk over current view on netlink dump", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-27017", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-28T16:20:37.656440Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:29.908Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:17:24.217Z" } } ] } }