CVE-2024-26910
Linux Kernel IPSet Netfilter Race Condition Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback.
INFO
Published Date :
April 17, 2024, 4:15 p.m.
Last Modified :
June 25, 2024, 10:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.0
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26910.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26910 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26910 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Apr. 29, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c No Types Assigned https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c Patch Changed Reference Type https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb No Types Assigned https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb Patch Changed Reference Type https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001 No Types Assigned https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001 Patch Changed Reference Type https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 No Types Assigned https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 Patch Changed Reference Type https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397 No Types Assigned https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397 Patch Changed Reference Type https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49 No Types Assigned https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49 Patch Changed Reference Type https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225 No Types Assigned https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225 Patch Added CWE NIST CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.4.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.79 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.18 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.6 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 17, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback. Added Reference kernel.org https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26910 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26910
weaknesses.