CVE-2024-27415: Linux kernel: netfilter: bridge: confirm multicast packets before passing them up the stack
Summary
CVE-2024-27415: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package for the Linux kernel. It provides the necessary header files and libraries for compiling programs that interact with the kernel. This package is an essential component for building and running applications on Linux systems. However, a vulnerability has been discovered in the package that affects its functionality and security.
Vulnerability Detail
The vulnerability in the linux-libc-dev package is related to the netfilter bridge functionality in the Linux kernel. It involves the handling of multicast (broadcast) packets on bridges. The conntrack nf_confirm logic is unable to handle cloned skbs referencing the same nf_conn entry, which can occur for multicast frames on bridges. This can lead to a race condition between the Macvlan broadcast worker and the normal confirm path, resulting in potential security issues. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package is vulnerable to a race condition in the netfilter bridge functionality of the Linux kernel. To mitigate this vulnerability, it is crucial to update the package to the latest version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package is a development package for the Linux kernel. It provides the necessary header files and libraries for compiling programs that interact with the kernel.
This vulnerability can potentially lead to security issues due to a race condition between the Macvlan broadcast worker and the normal confirm path in the netfilter bridge functionality of the Linux kernel.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later using the package manager update command specific to your Linux distribution.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
