In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks. On table/base chain deletion, nf_tables will attempt to unregister the hook again which yields a warn splat from the nftables core.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: establece el indicador inactivo en caso de error en el registro del enlace. Necesitamos configurar el indicador inactivo nuevamente si no logramos registrar los enlaces. Durante la presión de la memoria, el registro de ganchos puede fallar y terminamos con una tabla marcada como activa pero sin ganchos registrados. Al eliminar la tabla/cadena base, nf_tables intentará cancelar el registro del gancho nuevamente, lo que genera un símbolo de advertencia desde el núcleo de nftables.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e92c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e9940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3703bb040> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4eb140> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e8340> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc78ac0> | Operating System |
| linux | linux_kernel | 6.8 | <built-in method update of dict object at 0x7fd369a5fc80> | Operating System |
| linux | linux_kernel | 6.8 | <built-in method update of dict object at 0x7fd36a13b100> | Operating System |
| linux | linux_kernel | 6.8 | <built-in method update of dict object at 0x7fd39c4ebfc0> | Operating System |
| linux | linux_kernel | 6.8 | <built-in method update of dict object at 0x7fd39c4e8ac0> | Operating System |
| linux | linux_kernel | 6.8 | <built-in method update of dict object at 0x7fd340a13b40> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd36b119880> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |