CVE-2024-53141

netfilter: ipset: add missing range check in bitmap_ip_uadt

State: Published
Severity: 7.8 High
Published: Dec 6, 2024
Updated: Oct 15, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: add missing range check in bitmap_ip_uadt

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs.

So we should add missing range checks and remove unnecessary range checks.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	72205fc68bd13109576aa6c4c12c740962d28a6c to before 3c20b5948f119ae61ee35ad8584d666020c91581Affected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 78b0f2028f1043227a8eb0c41944027fc6a04596Affected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 2e151b8ca31607d14fddc4ad0f14da0893e1a7c7Affected 72205fc68bd13109576aa6c4c12c740962d28a6c to before e67471437ae9083fa73fa67eee1573fec1b7c8cfAffected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 7ffef5e5d5eeecd9687204a5ec2d863752aafb7eAffected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 856023ef032d824309abd5c747241dffa33aae8cAffected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 591efa494a1cf649f50a35def649c43ae984cd03Affected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 15794835378ed56fb9bacc6a5dd3b9f33520604eAffected 72205fc68bd13109576aa6c4c12c740962d28a6c to before 35f56c554eb1b56b77b3cf197a6b00922d49033dAffected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 4.19.325 through 4.19.Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

72205fc68bd13109576aa6c4c12c740962d28a6c to before 3c20b5948f119ae61ee35ad8584d666020c91581Affected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 78b0f2028f1043227a8eb0c41944027fc6a04596Affected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 2e151b8ca31607d14fddc4ad0f14da0893e1a7c7Affected
72205fc68bd13109576aa6c4c12c740962d28a6c to before e67471437ae9083fa73fa67eee1573fec1b7c8cfAffected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 7ffef5e5d5eeecd9687204a5ec2d863752aafb7eAffected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 856023ef032d824309abd5c747241dffa33aae8cAffected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 591efa494a1cf649f50a35def649c43ae984cd03Affected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 15794835378ed56fb9bacc6a5dd3b9f33520604eAffected
72205fc68bd13109576aa6c4c12c740962d28a6c to before 35f56c554eb1b56b77b3cf197a6b00922d49033dAffected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
4.19.325 through 4.19.*Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.