CVE-2024-26851
Linux kernel Netfilter H323 ASN1 Bitmap Length Shift Out-of-Bounds Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.
INFO
Published Date :
April 17, 2024, 11:15 a.m.
Last Modified :
April 2, 2025, 1:17 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26851.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26851 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26851 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Apr. 02, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.10 *cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.17 up to (excluding) 4.19.310 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.272 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.213 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.152 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.82 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.22 *cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Added Reference Type CVE: https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc Types: Patch Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Types: Mailing List Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Types: Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c Added Reference https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 Added Reference https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a Added Reference https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 Added Reference https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 Added Reference https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb Added Reference https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 Added Reference https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 05, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 17, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding. Added Reference kernel.org https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26851 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26851
weaknesses.