In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: exthdr: fix 4-byte stack OOB write
If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption.
This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.
The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.
Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-livepatch-4.14.343-259.562-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.198-187.748Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-4.14.336-257.566-debuginfoUpgrade kernel-livepatch-4.14.336-257.562Upgrade kernel-livepatch-4.14.336-257.568Upgrade kernel-livepatch-4.14.336-257.562-debuginfoUpgrade kernel-livepatch-4.14.343-261.564Upgrade kernel-livepatch-5.15.133-86.144Upgrade python-perfUpgrade kernel-livepatch-4.14.343-260.564Upgrade perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.343-259.562Upgrade kernel-livepatch-4.14.336-257.568-debuginfoUpgrade kernel-livepatch-4.14.343-260.564-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-livepatch-4.14.336-257.566Upgrade kernel-headers | Apr 26, 2024 | Mar 28, 2024 |
| Amazon_linux | — | Upgrade kernel | May 14, 2024 | Mar 28, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-livepatch-6.1.55-75.123Upgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade bpftool-debuginfo | Feb 17, 2025 | Mar 28, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Mar 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Oct 8, 2024 | Mar 28, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2024 | Mar 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | May 16, 2024 | Mar 28, 2024 |
| Suse | — | Upgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kernel-preemptUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-obs-qaUpgrade dtb-armUpgrade kernel-64kb-optionalUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-livepatch-develUpgrade kernel-docsUpgrade kernel-syms-rtUpgrade kernel-default-manUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-debugUpgrade kernel-rt-develUpgrade reiserfs-kmp-rtUpgrade dtb-hisiliconUpgrade gfs2-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade kernel-rt-livepatchUpgrade kernel-syms-azureUpgrade dtb-amdUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kernel-64kb-develUpgrade dlm-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade reiserfs-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-preempt-develUpgrade kernel-64kb-extraUpgrade kernel-rt_debugUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade kernel-rtUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-azure-baseUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade dtb-lgUpgrade dlm-kmp-rtUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade gfs2-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-freescaleUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade dtb-marvellUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-caviumUpgrade dtb-amazonUpgrade kernel-rt-vdsoUpgrade kernel-source-azureUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade dlm-kmp-64kb | Apr 18, 2024 | Mar 28, 2024 |
| Ubuntu | — | Upgrade linux-riscvUpgrade linux-ibm-5.15Upgrade linuxUpgrade linux-nvidia-tegraUpgrade linux-aws-5.4Upgrade linux-azure-fdeUpgrade linux-aws-hweUpgrade linux-gkeUpgrade linux-nvidiaUpgrade linux-aws-5.15Upgrade linux-oem-6.5Upgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linux-xilinx-zynqmpUpgrade linux-nvidia-tegra-5.15Upgrade linux-fipsUpgrade linux-realtimeUpgrade linux-ibm-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-oracle-5.15Upgrade linux-raspiUpgrade linux-lowlatencyUpgrade linux-azure-6.5Upgrade linux-gkeopUpgrade linux-iotUpgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-azure-5.4Upgrade linux-hweUpgrade linux-gcp-4.15Upgrade linux-gcpUpgrade linux-hwe-5.4Upgrade linux-gkeop-5.15Upgrade linux-bluefieldUpgrade linux-azureUpgrade linux-aws-6.5Upgrade linux-intel-iotg-5.15Upgrade linux-gcp-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-starfiveUpgrade linux-hwe-5.15Upgrade linux-kvmUpgrade linux-lts-xenialUpgrade linux-gcp-5.4Upgrade linux-oracleUpgrade linux-laptopUpgrade linux-azure-fipsUpgrade linux-ibmUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-gcp-5.15Upgrade linux-nvidia-tegra-igx | Nov 19, 2024 | Mar 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub