CVE-2023-52581 netfilter: nf_tables: fix memleak when more than 255 elements expired

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before reaching the boundary...

CVE-2023-52581

CVE-2023-52581 : Linux kernel netfilter nft_tables memo‑leak when more than 255 elements expire. Root cause: u8 wrap occurs before boundary and nft_trans_gc_space() returns true, causing recycle of the initial gc container and loss of earlier elements. Also fixes dereferencing GC after handing it...

CVE-2023-52581 netfilter: nf_tables: fix memleak when more than 255 elements expired

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before reaching the boundary...

CVE-2024-26609

CVE-2024-26609 is listed in the MiracleLinux AXSA advisory as a Linux kernel nf_tables issue described as: "nf_tables: reject QUEUE/DROP verdict parameters". The connected document provides only this terse kernel-note reference and does not supply exploitation details, affected versions, impact, ...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...

CVE-2021-46992

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid overflows in nfthashbuckets Number of buckets being stored in 32bit variables, we have to ensure that no overflows occur in nfthashbuckets syzbot injected a size == 0x40000000 and reported: UBSAN:...

RHEL 9 : kernel-rt (RHSA-2024:1019)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1019 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

CVE-2023-52433

A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nftsetrbtree, where new elements in this transaction might expire before the transaction ends. Skip sync GC for such elements, otherwise a commit path might walk over an already released object. Once the...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-060)

The version of kernel installed on the remote host is prior to 5.4.268-181.370. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-060 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve loca...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-517)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-517 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling CVE-2023-52486 In the Linux kernel, the following...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-050)

The version of kernel installed on the remote host is prior to 5.10.209-198.858. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-050 advisory. 2024-12-05: CVE-2024-26687 was added to this advisory. A use-after-free vulnerability in the Linux...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftsetelemcatchalldeactivate function checks whether the catch-all set element is active in the current generation instead of the next...

Amazon Linux 2 : kernel (ALAS-2024-2453)

The version of kernel installed on the remote host is prior to 4.14.336-256.559. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2453 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Amazon Linux AMI : kernel (ALAS-2024-1919)

The version of kernel installed on the remote host is prior to 4.14.336-179.559. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1919 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privile...

CLSA-2024-1707478061 kernel: Fix of 11 CVEs

netfilter: nftables: reject QUEUE/DROP verdict parameters CVE-2024-1086 - RDMA/core: Refactor rdmabindaddr CVE-2023-2176 - RDMA/cma: Do not change route.addr.srcaddr outside state checks - RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests - drm/amdgpu: Fix potential fence...