A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nftbyteordereval() function, where the code iterates through a loop and writes to the dst array. On each iteration, 8 bytes are written, but dst is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0607.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"52231141798375173235126828289743002537",
"189489569235763524219129352866035923371",
"34913753387746942440507405103672633156",
"109153964900260438587885229034859563072"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-0607-1d03e718",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"file": "net/netfilter/nft_meta.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1367.0,
"function_hash": "303534739883534694056946341094158453797"
},
"signature_type": "Function",
"id": "CVE-2024-0607-944b74db",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"function": "nft_byteorder_eval",
"file": "net/netfilter/nft_byteorder.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 305.0,
"function_hash": "158367409985641630087712394608863576345"
},
"signature_type": "Function",
"id": "CVE-2024-0607-9fa8de81",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"function": "nft_meta_get_eval_time",
"file": "net/netfilter/nft_meta.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"82913766467653735877679672364554454432",
"279029749780145337134943555404324047429",
"175873775696537495513574527746131792874",
"292561116218026597191673164357195215656",
"155332187043805546992401233114546114869",
"23058062857348577495778496897490177645"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-0607-a17caed9",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"file": "include/net/netfilter/nf_tables.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"166877081431173914901107539929498505164",
"116547180793652212748771454985466039759",
"256724324222714791214088555207442448744",
"245393798039635944282369480234083857986",
"89661098097557213359162780860127454388",
"52268082829988968365900901889424938118",
"104721583420100073256268635341097836160",
"160165499818772338240044561836870681847",
"131563338779195214914226854799347870117",
"199249677345301825460231254350038810002",
"293310808889917364719586620465402313294",
"56743253269123784995028211834871700055",
"234652273671023716863278350942903661059",
"57237156111741497160740342877878992036"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-0607-e8e282be",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"file": "net/netfilter/nft_byteorder.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 105.0,
"function_hash": "273549984749111291784167380198457856988"
},
"signature_type": "Function",
"id": "CVE-2024-0607-eaf22a11",
"source": "https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
"target": {
"function": "nft_reg_store64",
"file": "include/net/netfilter/nf_tables.h"
}
}
]