CVE-2024-41042

HIGH EPSS 23.8%
Published Jul 29, 20241y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jul 29, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace).

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
23.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 14

VendorProductVersionRange
linuxlinux_kernel*≥3.13  –  <4.19.320
linuxlinux_kernel*≥4.20  –  <5.4.282
linuxlinux_kernel*≥5.5  –  <5.10.224
linuxlinux_kernel*≥5.11  –  <5.15.165
linuxlinux_kernel*≥5.16  –  <6.1.105
linuxlinux_kernel*≥6.2  –  <6.6.46
linuxlinux_kernel*≥6.7  –  <6.9.10
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any

References 10

  • git.kernel.org https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c
    Patch