Linux Kernel up to 6.4 Netfilter information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.4. The affected element is an unknown function of the component Netfilter. Executing a manipulation can lead to information disclosure. This vulnerability is registered as CVE-2024-26643. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.4. It has been declared as problematic. This vulnerability affects some unknown functionality of the component Netfilter. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2024-26643 since 02/19/2024. The exploitation appears to be difficult. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 243301 (SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02588-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.8 eliminates this vulnerability. Applying the patch 552705a3650b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (243301). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion