kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftflowtabletypeget The Linux kernel CVE team has assigned CVE-2024-35898 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftflowtabletypeget The Linux kernel CVE team has assigned CVE-2024-35898 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fully validate NFTDATAVALUE on store to data registers register store validation for NFTDATAVALUE is conditional, however, the datatype is always either NFTDATAVALUE or NFTDATAVERDICT. This only requires a ne...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use CVE-2024-26921 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump...

DEBIAN-CVE-2024-49987

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsortNULL, 0, ... When netfilter has no entry to display, qsort is called with qsortNULL, 0, .... This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer...

AZL-52613 CVE-2024-49952 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption syzbot found that nfdupipv4 or nfdupipv6 could write per-cpu variable nfskbduplicated in an unsafe way 1. Disabling preemption as hinted by the splat is not enough, we have ...

AZL-51000 CVE-2024-47685 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfrejectipv6: fix nfrejectip6tcphdrput syzbot reported that nfrejectip6tcphdrput was possibly sending garbage on the four reserved tcp bits th-res1 Use skbputzero to clear the whole TCP header, as done in...

DEBIAN-CVE-2024-47685

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfrejectipv6: fix nfrejectip6tcphdrput syzbot reported that nfrejectip6tcphdrput was possibly sending garbage on the four reserved tcp bits th-res1 Use skbputzero to clear the whole TCP header, as done in...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an initialization value issue in the netfilter nfrejectipv6 module nfrejectip6tcphdrput function...

Malicious code in nf-gestures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd3132b2cb17bc426c78b10555ce9246e42cab57a2a164d063850deb200c0ac1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9436 Malicious code in nf-gestures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd3132b2cb17bc426c78b10555ce9246e42cab57a2a164d063850deb200c0ac1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nf-cl-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a07e531cde3becef826740710d90cfb37d46917ae9a633d794a641b4f04c737 The OpenSSF Package Analysis project identified 'nf-cl-logger' @ 30.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9066 Malicious code in nf-cl-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a07e531cde3becef826740710d90cfb37d46917ae9a633d794a641b4f04c737 The OpenSSF Package Analysis project identified 'nf-cl-logger' @ 30.0.0 npm as malicious. It is considered malicious because: - The package...

kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable()

An out-of-bounds access vulnerability was found in the Linux Kernel. This issue occurs during the creation of a new netfilter table. The absence of safeguards in the nftablesnewtable function against invalid nftables family pf values allows attackers to achieve unauthorized access. Exploitation...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

A flaw was found in the Linux kernel. A potential data-race in the nftexprtypeget function exists...

kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftflowtabletypeget The Linux kernel CVE team has assigned CVE-2024-35898 to this issue. Upstream advisory:...

SUSE CVE-2024-46782

In the Linux kernel, the following vulnerability has been resolved: ila: call nfunregisternethooks sooner syzbot found an use-after-free Read in ilanfinput 1 Issue here is that ilaxlatexitnet frees the rhashtable, then call nfunregisternethooks. It should be done in the reverse way, with a...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

A potential data-race flaw was found in nftobjtypeget in the Linux kernel. This issue can lead to a crash...

CVE-2024-46782 ila: call nf_unregister_net_hooks() sooner

In the Linux kernel, the following vulnerability has been resolved: ila: call nfunregisternethooks sooner syzbot found an use-after-free Read in ilanfinput 1 Issue here is that ilaxlatexitnet frees the rhashtable, then call nfunregisternethooks. It should be done in the reverse way, with a...