In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.
According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
[
{
"id": "CVE-2024-26643-099afea8",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d45f467096e931044f0ab7634499879d851a5c",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-13cbfdd9",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-1976959f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@406b0241d0eb598a0b330ab20ae325537d8d8163",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-1e6e1455",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@552705a3650bbf46a22b1adedc1b04181490fc36",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-28ef5ed6",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d75a589bb92af1abf3b779cfcd1977ca11b27033",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-2f26506c",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5224afbc30c3ca9ba23e752f0f138729b2c48dd8",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-4b2785a5",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291cca35818bd52a407bc37ab45a15816039e363",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-749750e7",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@552705a3650bbf46a22b1adedc1b04181490fc36",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-7c5f875d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-9170d3c0",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5224afbc30c3ca9ba23e752f0f138729b2c48dd8",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-a6f8a1cd",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d75a589bb92af1abf3b779cfcd1977ca11b27033",
"signature_type": "Function",
"digest": {
"length": 288.0,
"function_hash": "114158568995315930033771713951059659236"
}
},
{
"id": "CVE-2024-26643-d4fd6ab4",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d45f467096e931044f0ab7634499879d851a5c",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-dfc6dbe7",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
},
{
"id": "CVE-2024-26643-e4b8d5e0",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291cca35818bd52a407bc37ab45a15816039e363",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-e72a502d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@406b0241d0eb598a0b330ab20ae325537d8d8163",
"signature_type": "Line",
"digest": {
"line_hashes": [
"216701269070329248940163749807763276511",
"32600929826536836541516064039397631674",
"127308397417742174520596735874044524420",
"45828386588244406052682971749613059250"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-26643-efdb1b21",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_unbind_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf",
"signature_type": "Function",
"digest": {
"length": 295.0,
"function_hash": "224374560223304276060183321890807974851"
}
}
]