CVE-2024-27017

netfilter: nft_set_pipapo: walk over current view on netlink dump

State: Published
Severity: 7.8 High
Published: May 1, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: walk over current view on netlink dump

The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set.

Based on patch from Florian Westphal.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2a90da8e0dd50f42e577988f4219f4f4cd3616b7 to before ff89db14c63a827066446460e39226c0688ef786Affected 45eb6944d0f55102229115de040ef3a48841434a to before ce9fef54c5ec9912a0c9a47bac3195cc41b14679Affected 0d836f917520300a8725a5dbdad4406438d0cead to before 52735a010f37580b3a569a996f878fdd87425650Affected 2b84e215f87443c74ac0aa7f76bb172d43a87033 to before f24d8abc2bb8cbf31ec713336e402eafa8f42f60Affected 2b84e215f87443c74ac0aa7f76bb172d43a87033 to before 721715655c72640567e8742567520c99801148edAffected 2b84e215f87443c74ac0aa7f76bb172d43a87033 to before 29b359cf6d95fd60730533f7f10464e95bd17c73Affected f661383b5f1aaac3fe121b91e04332944bc90193Affected 5.10.186 to before 5.10.227Affected 5.15.119 to before 5.15.168Affected 6.1.36 to before 6.1.112Affected 6.3.10 to before 6.4Affected
LinuxLinux	6.4Affected before 6.4Not affected 5.10.227 through 5.10.Not affected 5.15.168 through 5.15.Not affected 6.1.112 through 6.1.Not affected 6.6.53 through 6.6.Not affected 6.8.8 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

2a90da8e0dd50f42e577988f4219f4f4cd3616b7 to before ff89db14c63a827066446460e39226c0688ef786Affected
45eb6944d0f55102229115de040ef3a48841434a to before ce9fef54c5ec9912a0c9a47bac3195cc41b14679Affected
0d836f917520300a8725a5dbdad4406438d0cead to before 52735a010f37580b3a569a996f878fdd87425650Affected
2b84e215f87443c74ac0aa7f76bb172d43a87033 to before f24d8abc2bb8cbf31ec713336e402eafa8f42f60Affected
2b84e215f87443c74ac0aa7f76bb172d43a87033 to before 721715655c72640567e8742567520c99801148edAffected
2b84e215f87443c74ac0aa7f76bb172d43a87033 to before 29b359cf6d95fd60730533f7f10464e95bd17c73Affected
f661383b5f1aaac3fe121b91e04332944bc90193Affected
5.10.186 to before 5.10.227Affected
5.15.119 to before 5.15.168Affected
6.1.36 to before 6.1.112Affected
6.3.10 to before 6.4Affected

LinuxLinux

6.4Affected
before 6.4Not affected
5.10.227 through 5.10.*Not affected
5.15.168 through 5.15.*Not affected
6.1.112 through 6.1.*Not affected
6.6.53 through 6.6.*Not affected
6.8.8 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.