In the Linux kernel, the following vulnerability has been resolved:
netfilter: complete validation of user input
In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.
In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:
if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-coreUpgrade python3-perfUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-develUpgrade rvUpgrade kernelUpgrade kernel-rt-debugUpgrade kernel-64kUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-64k-modules-coreUpgrade rtlaUpgrade kernel-zfcpdump | Nov 4, 2024 | May 20, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-devel | May 22, 2025 | May 20, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 20, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 20, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Oct 9, 2024 | May 20, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Oct 8, 2024 | May 20, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 20, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Sep 13, 2024 | May 20, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kselftests-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debug-develUpgrade kernel-default-manUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-azure-baseUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-azure-develUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-amlogicUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade kernel-azure-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-rt-extraUpgrade dtb-armUpgrade kernel-syms-azureUpgrade kernel-azureUpgrade kernel-sourceUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-rt_debugUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade dtb-appleUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade dtb-xilinxUpgrade dtb-apmUpgrade kernel-docs-htmlUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-freescaleUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-amazonUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade gfs2-kmp-azureUpgrade dtb-lgUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-debug-develUpgrade kernel-debugUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-extraUpgrade dtb-marvellUpgrade dtb-alteraUpgrade kernel-develUpgrade kernel-default-develUpgrade kernel-azure-extra | Jul 10, 2024 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub