CVE-2024-26609 Information

Mar 12, 2024 cve

Description

In the Linux kernel the following vulnerability has been resolved:

netfilter: nf_tables: reject QUEUE/DROP verdict parameters

This reverts commit e0abdadcc6e1.

core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP verdicts contain a valid errno i.e. -EPERM -EHOSTUNREACH or similar or 0.

Due to the reverted commit its possible to provide a positive value e.g. NF_ACCEPT (1) which results in use-after-free.

Its not clear to me why this commit was made.

NF_QUEUE is not used by nftables; \queue\ rules in nftables will result in use of ft_queue\ expression.

If we later need to allow specifiying errno values from userspace (do not know why) this has to call NF_DROP_GETERR and check that rr <= 0\ holds true.

Reference

Share on: