In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: Fix potential data-race in _nftexprtypeget()
nftunregisterexpr() can concurrent with __nftexprtype_get(), and there is not any protection when iterate over nftablesexpressions list in _nftexprtypeget(). Therefore, there is potential data-race of nftablesexpressions list entry.
Use listforeachentryrcu() to iterate over nftablesexpressions list in __nftexprtypeget(), and use rcureadlock() in the caller nftexprtypeget() to protect the entire type query process.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27020.json"
}[
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-27020-06fcbd98",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"75098032936433755512921020029464918555",
"168122694166416523239619478306935935122",
"95668585384223896742238436877733258386",
"277868676002708200661840065849682954426",
"81833538427388819145620825169476819041",
"199994187592644880172784227158510490579",
"90846442451590115924634620143595257567",
"48134192603229536978557728599866705793",
"103107768598676315561901701637062970985",
"19047983003822207435336081062356249151"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@934e66e231cff2b18faa2c8aad0b8cec13957e05"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-27020-b2dad37c",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "__nft_expr_type_get"
},
"digest": {
"length": 313.0,
"function_hash": "105498827998937985556923152248004219071"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@934e66e231cff2b18faa2c8aad0b8cec13957e05"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-27020-c93f4732",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_expr_type_get"
},
"digest": {
"length": 575.0,
"function_hash": "167546582171523148661367832186376369564"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@934e66e231cff2b18faa2c8aad0b8cec13957e05"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27020.json"