In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: exthdr: fix 4-byte stack OOB write
If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption.
This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.
The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.
Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.343-260.564-debuginfoUpgrade kernel-livepatch-4.14.343-260.564Upgrade perfUpgrade kernel-livepatch-4.14.336-257.568-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.336-257.566Upgrade kernel-livepatch-4.14.343-259.562Upgrade python-perfUpgrade kernel-livepatch-4.14.336-257.566-debuginfoUpgrade kernel-livepatch-4.14.336-257.562Upgrade kernel-toolsUpgrade kernel-livepatch-4.14.336-257.568Upgrade kernel-livepatch-5.10.198-187.748Upgrade kernel-livepatch-5.15.133-86.144Upgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.336-257.562-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-4.14.343-261.564Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.343-259.562-debuginfo | Apr 26, 2024 | Mar 28, 2024 |
| Amazon_linux | — | Upgrade kernel | May 14, 2024 | Mar 28, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade kernel-livepatch-6.1.55-75.123Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-toolsUpgrade perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf | Feb 17, 2025 | Mar 28, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Mar 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Oct 8, 2024 | Mar 28, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2024 | Mar 28, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 16, 2024 | Mar 28, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade kernel-obs-buildUpgrade dtb-caviumUpgrade kernel-azure-extraUpgrade dtb-exynosUpgrade dtb-alteraUpgrade dtb-lgUpgrade kernel-azureUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade kernel-rt-vdsoUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade dtb-amazonUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade dtb-allwinnerUpgrade kernel-preempt-develUpgrade dtb-appleUpgrade kernel-rt_debugUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-baseUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-default-livepatchUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-defaultUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-azureUpgrade dtb-rockchipUpgrade kernel-debug-vdsoUpgrade kernel-default-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade kernel-source-rtUpgrade kselftests-kmp-rtUpgrade dtb-amdUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade kselftests-kmp-defaultUpgrade kernel-devel-azureUpgrade dtb-xilinxUpgrade kernel-preemptUpgrade dtb-hisiliconUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-64kbUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade kernel-azure-vdsoUpgrade dtb-mediatekUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade gfs2-kmp-64kbUpgrade kernel-macrosUpgrade dtb-armUpgrade kernel-debugUpgrade dtb-socionextUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-develUpgrade dtb-apmUpgrade kernel-debug-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatchUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rt | Apr 18, 2024 | Mar 28, 2024 |
| Ubuntu | — | Upgrade linux-azure-5.15Upgrade linux-oracleUpgrade linux-azure-5.4Upgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-starfiveUpgrade linux-ibmUpgrade linux-awsUpgrade linux-gcp-5.15Upgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-azure-fipsUpgrade linux-gcp-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-iotUpgrade linux-laptopUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-gcp-4.15Upgrade linux-bluefieldUpgrade linux-azure-4.15Upgrade linux-gkeop-5.15Upgrade linux-lts-xenialUpgrade linux-intel-iot-realtimeUpgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-gkeopUpgrade linux-aws-6.5Upgrade linux-gcpUpgrade linux-hwe-5.15Upgrade linux-fipsUpgrade linux-nvidia-tegraUpgrade linux-nvidiaUpgrade linux-aws-5.15Upgrade linux-aws-hweUpgrade linux-oem-6.5Upgrade linux-aws-5.4Upgrade linux-lowlatencyUpgrade linux-nvidia-tegra-5.15Upgrade linux-oracle-5.4Upgrade linux-intel-iotgUpgrade linux-raspiUpgrade linux-realtimeUpgrade linux-oracle-5.15Upgrade linux-gkeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-fdeUpgrade linux-xilinx-zynqmpUpgrade linuxUpgrade linux-ibm-5.4Upgrade linux-azure-6.5Upgrade linux-riscv-5.15Upgrade linux-riscvUpgrade linux-ibm-5.15 | Nov 19, 2024 | Mar 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub