CVE-2024-27403: linux-libc-dev - netfilter: nft_flow_offload: reset dst in route object after setting up flow
Summary
CVE-2024-27403: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build applications that interact with the Linux kernel. This package contains the necessary files for building kernel modules and other software that needs to interface with the kernel. The linux-libc-dev package is vulnerable to a specific issue related to netfilter and nft_flow_offload.
Vulnerability Detail
The vulnerability in linux-libc-dev (CVE-2024-27403) is related to the netfilter component and specifically the nft_flow_offload feature. The issue arises when the 'dst' (destination) is transferred to the flow object, but the route object does not own it anymore. This can lead to a refcount underflow if the flow_offload_add() function fails. The vulnerability could potentially be exploited to cause a denial-of-service (DoS) condition. The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section and update the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package is vulnerable to a medium severity issue related to netfilter and nft_flow_offload. To mitigate the vulnerability, it is recommended to update the package to the latest version. Regularly updating the package is crucial to stay protected against known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build applications that interact with the Linux kernel.
Netfilter is a framework within the Linux kernel that allows various network-related operations, such as packet filtering, network address translation (NAT), and port forwarding.
nft_flow_offload is a feature in netfilter that offloads flow-related operations to hardware or software accelerators, improving performance and efficiency.
A refcount underflow occurs when the reference count of an object becomes negative, indicating a potential memory management issue.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
