In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.
According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-develUpgrade rtlaUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade libperfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdumpUpgrade python3-perfUpgrade kernel-uki-virtUpgrade kernel-64k-modules-coreUpgrade kernel-develUpgrade kernel-docUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64kUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-coreUpgrade rvUpgrade kernel-cross-headersUpgrade kernel-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-64k-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernelUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-develUpgrade kernel-rt-kvm | Jun 6, 2024 | Mar 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-livepatch-5.10.215-203.850Upgrade kernel-tools-develUpgrade kernelUpgrade perfUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.156-102.160Upgrade kernel-tools-debuginfo | Jul 9, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.84-99.169Upgrade kernelUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade bpftoolUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade perf | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade linux | Apr 15, 2024 | Mar 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelists | Jun 26, 2024 | Mar 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftool | Oct 8, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade kernel | May 25, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | May 30, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-cross-headersUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfoUpgrade kernel-headersUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debug-develUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debug-core | Jun 17, 2024 | Mar 21, 2024 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-rt-vdsoUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-source-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-qaUpgrade dtb-amazonUpgrade dtb-apmUpgrade kernel-default-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-extraUpgrade dlm-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade kernel-azure-develUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade dtb-appleUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-64kbUpgrade kernel-64kb-livepatch-develUpgrade kernel-develUpgrade kernel-preempt-develUpgrade kernel-rt-develUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-symsUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade kernel-sourceUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade dtb-mediatekUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade dtb-sprdUpgrade dtb-allwinnerUpgrade dtb-exynosUpgrade kernel-default-optionalUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-lgUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-preemptUpgrade gfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade kernel-rt_debug-develUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade dtb-armUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-default | Jun 13, 2024 | Mar 21, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-5.4.0-187-generic-lpaeUpgrade linux-image-6.5.0-1019-raspiUpgrade linux-image-6.5.0-42-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-raspi2Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1087-bluefieldUpgrade linux-image-5.15.0-1067-azure-fdeUpgrade linux-image-bluefieldUpgrade linux-image-6.5.0-42-lowlatencyUpgrade linux-image-6.5.0-1022-nvidia-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1063-gcpUpgrade linux-image-5.4.0-1131-gcpUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-azure-lts-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.4.0-1132-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1067-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1126-oracleUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-6.5.0-1023-azure-fdeUpgrade linux-image-oem-22.04aUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1061-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.15.0-1062-oracleUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-nvidiaUpgrade linux-image-6.5.0-1023-azureUpgrade linux-image-5.4.0-187-genericUpgrade linux-image-5.15.0-1059-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.4.0-1127-awsUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-kvmUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-intel-iotgUpgrade linux-image-oemUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.4.0-1039-iotUpgrade linux-image-6.5.0-1022-nvidiaUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-awsUpgrade linux-image-gkeopUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1064-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.5.0-1023-gcpUpgrade linux-image-6.5.0-1025-oracle-64kUpgrade linux-image-6.5.0-1025-oemUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-6.5.0-1025-oracleUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-6.5.0-42-generic-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-oracleUpgrade linux-image-5.4.0-1074-ibmUpgrade linux-image-6.5.0-1016-starfiveUpgrade linux-image-5.15.0-113-lowlatency-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-starfiveUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1111-raspiUpgrade linux-image-6.5.0-1022-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-gkeUpgrade linux-image-6.5.0-1018-laptopUpgrade linux-image-5.15.0-1059-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1061-kvmUpgrade linux-image-5.4.0-1094-gkeopUpgrade linux-image-raspiUpgrade linux-image-6.5.0-42-genericUpgrade linux-image-5.15.0-1047-gkeopUpgrade linux-image-laptop-23.10Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1115-kvmUpgrade linux-image-intelUpgrade linux-image-5.4.0-187-lowlatencyUpgrade linux-image-nvidia-6.5Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-113-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-5.4.0-1046-xilinx-zynqmpUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1059-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1031-xilinx-zynqmp | Jul 4, 2024 | Mar 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub