CVE-2024-40993 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix suspicious rcu_dereference_protected() When destroying all sets, we are either in pernet exit phase or are executing a "destroy all sets command" from userspace. The latter was taken into account in ip_set_dereference() (nfnetlink mutex is held), but the former was not. The patch adds the required check to rcu_dereference_protected() in ip_set_dereference().

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1
https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5
https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2
https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a
https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33
https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6
https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4
https://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40993-ee08@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40993
https://www.cve.org/CVERecord?id=CVE-2024-40993

History

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:37:36.453Z

Updated: 2024-12-19T09:09:38.815Z

Reserved: 2024-07-12T12:17:45.606Z

Link: CVE-2024-40993

Vulnrichment

Updated: 2024-09-11T12:42:22.052Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:20.553

Modified: 2024-11-21T09:32:01.410

Link: CVE-2024-40993

Redhat

Severity : Moderate

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40993 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40993", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.606Z", "datePublished": "2024-07-12T12:37:36.453Z", "dateUpdated": "2024-12-19T09:09:38.815Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:09:38.815Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Fix suspicious rcu_dereference_protected()\n\nWhen destroying all sets, we are either in pernet exit phase or\nare executing a \"destroy all sets command\" from userspace. The latter\nwas taken into account in ip_set_dereference() (nfnetlink mutex is held),\nbut the former was not. The patch adds the required check to\nrcu_dereference_protected() in ip_set_dereference()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_core.c"], "versions": [{"version": "c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3", "lessThan": "3799d02ae4208af08e81310770d8754863a246a1", "status": "affected", "versionType": "git"}, {"version": "93b53c202b51a69e42ca57f5a183f7e008e19f83", "lessThan": "72d9611968867cc4c5509e7708b1507d692b797a", "status": "affected", "versionType": "git"}, {"version": "0f1bb77c6d837c9513943bc7c08f04c5cc5c6568", "lessThan": "523bed6489e089dd8040e72453fb79da47b144c2", "status": "affected", "versionType": "git"}, {"version": "390b353d1a1da3e9c6c0fd14fe650d69063c95d6", "lessThan": "788d585e62f487bc4536d454937f737b70d39a33", "status": "affected", "versionType": "git"}, {"version": "2ba35b37f780c6410bb4bba9c3072596d8576702", "lessThan": "94dd411c18d7fff9e411555d5c662d29416501e4", "status": "affected", "versionType": "git"}, {"version": "90ae20d47de602198eb69e6cd7a3db3420abfc08", "lessThan": "3fc09e1ca854bc234e007a56e0f7431f5e2defb5", "status": "affected", "versionType": "git"}, {"version": "4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10", "lessThan": "8ecd06277a7664f4ef018abae3abd3451d64e7a6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_core.c"], "versions": [{"version": "6.1.95", "lessThan": "6.1.96", "status": "affected", "versionType": "semver"}, {"version": "6.6.35", "lessThan": "6.6.36", "status": "affected", "versionType": "semver"}, {"version": "6.9.6", "lessThan": "6.9.7", "status": "affected", "versionType": "semver"}]}], "references": [{"url": "https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1"}, {"url": "https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a"}, {"url": "https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2"}, {"url": "https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33"}, {"url": "https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4"}, {"url": "https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5"}, {"url": "https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6"}], "title": "netfilter: ipset: Fix suspicious rcu_dereference_protected()", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.065Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:41.687653Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.022Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40993", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.606Z", "datePublished": "2024-07-12T12:37:36.453Z", "dateUpdated": "2024-08-02T04:39:56.065Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:52:58.373Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Fix suspicious rcu_dereference_protected()\n\nWhen destroying all sets, we are either in pernet exit phase or\nare executing a \"destroy all sets command\" from userspace. The latter\nwas taken into account in ip_set_dereference() (nfnetlink mutex is held),\nbut the former was not. The patch adds the required check to\nrcu_dereference_protected() in ip_set_dereference()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_core.c"], "versions": [{"version": "c0761d1f1ce1", "lessThan": "3799d02ae420", "status": "affected", "versionType": "git"}, {"version": "93b53c202b51", "lessThan": "72d961196886", "status": "affected", "versionType": "git"}, {"version": "0f1bb77c6d83", "lessThan": "523bed6489e0", "status": "affected", "versionType": "git"}, {"version": "390b353d1a1d", "lessThan": "788d585e62f4", "status": "affected", "versionType": "git"}, {"version": "2ba35b37f780", "lessThan": "94dd411c18d7", "status": "affected", "versionType": "git"}, {"version": "90ae20d47de6", "lessThan": "3fc09e1ca854", "status": "affected", "versionType": "git"}, {"version": "4e7aaa6b82d6", "lessThan": "8ecd06277a76", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_core.c"], "versions": [{"version": "6.1.95", "lessThan": "6.1.96", "status": "affected", "versionType": "custom"}, {"version": "6.6.35", "lessThan": "6.6.36", "status": "affected", "versionType": "custom"}, {"version": "6.9.6", "lessThan": "6.9.7", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1"}, {"url": "https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a"}, {"url": "https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2"}, {"url": "https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33"}, {"url": "https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4"}, {"url": "https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5"}, {"url": "https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6"}], "title": "netfilter: ipset: Fix suspicious rcu_dereference_protected()", "x_generator": {"engine": "bippy-c9c4e1df01b2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:41.687653Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-09-11T12:42:22.052Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Fix suspicious rcu_dereference_protected()\n\nWhen destroying all sets, we are either in pernet exit phase or\nare executing a \"destroy all sets command\" from userspace. The latter\nwas taken into account in ip_set_dereference() (nfnetlink mutex is held),\nbut the former was not. The patch adds the required check to\nrcu_dereference_protected() in ip_set_dereference()."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: ipset: corrige rcu_dereference_protected() sospechoso Al destruir todos los conjuntos, estamos en la fase de salida de pernet o estamos ejecutando un \"comando de destruir todos los conjuntos\" desde el espacio de usuario. Este \u00faltimo se tuvo en cuenta en ip_set_dereference() (se mantiene el mutex de nfnetlink), pero el primero no. El parche agrega la verificaci\u00f3n requerida a rcu_dereference_protected() en ip_set_dereference()."}], "id": "CVE-2024-40993", "lastModified": "2024-11-21T09:32:01.410", "metrics": {}, "published": "2024-07-12T13:15:20.553", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}