In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftflowoffload: reset dst in route object after setting up flow
dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flowoffloadadd() fails, error path releases dst twice, leading to a refcount underflow.
[
{
"digest": {
"length": 1511.0,
"function_hash": "119691038753177205877027338850703189350"
},
"target": {
"function": "flow_offload_fill_route",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@670548c8db44d76e40e1dfc06812bca36a61e9ae",
"id": "CVE-2024-27403-07435342",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"85413158487071431983359407450988760339",
"151849709998637601216535688733515398118",
"298076482626880251000106949719315968763",
"203455904139779229144160563807570345967",
"66300613569759129224772007382574878286",
"245383150315700702430295672563419414650",
"298420927001963055762480306157996413696",
"184098562393235508355272194895861068566",
"16108937004529224198027684271483600481",
"319240984148499666357463427765224740930",
"86491646890737387300064813996079706701",
"258641331174757958380533901624786526946",
"237415130339402078785918805195260802823"
],
"threshold": 0.9
},
"target": {
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c",
"id": "CVE-2024-27403-18b77fe3",
"signature_type": "Line"
},
{
"digest": {
"length": 1511.0,
"function_hash": "119691038753177205877027338850703189350"
},
"target": {
"function": "flow_offload_fill_route",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@012df10717da02367aaf92c65f9c89db206c15f4",
"id": "CVE-2024-27403-3295207b",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"85413158487071431983359407450988760339",
"151849709998637601216535688733515398118",
"298076482626880251000106949719315968763",
"203455904139779229144160563807570345967",
"66300613569759129224772007382574878286",
"245383150315700702430295672563419414650",
"298420927001963055762480306157996413696",
"184098562393235508355272194895861068566",
"16108937004529224198027684271483600481",
"319240984148499666357463427765224740930",
"86491646890737387300064813996079706701",
"258641331174757958380533901624786526946",
"237415130339402078785918805195260802823"
],
"threshold": 0.9
},
"target": {
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@670548c8db44d76e40e1dfc06812bca36a61e9ae",
"id": "CVE-2024-27403-66db2905",
"signature_type": "Line"
},
{
"digest": {
"length": 1511.0,
"function_hash": "119691038753177205877027338850703189350"
},
"target": {
"function": "flow_offload_fill_route",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c",
"id": "CVE-2024-27403-69c63064",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"4250437117098366649221834395383671759",
"313281559949318056948119098523474319520",
"235892331336681489917154185590474994128",
"95323144025200954508236587138587187090"
],
"threshold": 0.9
},
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@670548c8db44d76e40e1dfc06812bca36a61e9ae",
"id": "CVE-2024-27403-7ce1932f",
"signature_type": "Line"
},
{
"digest": {
"length": 1511.0,
"function_hash": "119691038753177205877027338850703189350"
},
"target": {
"function": "flow_offload_fill_route",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558b00a30e05753a62ecc7e05e939ca8f0241148",
"id": "CVE-2024-27403-7e47c329",
"signature_type": "Function"
},
{
"digest": {
"length": 209.0,
"function_hash": "182448549340161274143776333624735897750"
},
"target": {
"function": "flow_offload_route_init",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e0f0430389be7696396c62f037be4bf72cf93e3",
"id": "CVE-2024-27403-80c1f4ec",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"85413158487071431983359407450988760339",
"151849709998637601216535688733515398118",
"298076482626880251000106949719315968763",
"203455904139779229144160563807570345967",
"66300613569759129224772007382574878286",
"245383150315700702430295672563419414650",
"298420927001963055762480306157996413696",
"184098562393235508355272194895861068566",
"16108937004529224198027684271483600481",
"319240984148499666357463427765224740930",
"86491646890737387300064813996079706701",
"258641331174757958380533901624786526946",
"237415130339402078785918805195260802823"
],
"threshold": 0.9
},
"target": {
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@012df10717da02367aaf92c65f9c89db206c15f4",
"id": "CVE-2024-27403-9541c832",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"4250437117098366649221834395383671759",
"313281559949318056948119098523474319520",
"235892331336681489917154185590474994128",
"95323144025200954508236587138587187090"
],
"threshold": 0.9
},
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558b00a30e05753a62ecc7e05e939ca8f0241148",
"id": "CVE-2024-27403-9fa1b15e",
"signature_type": "Line"
},
{
"digest": {
"length": 209.0,
"function_hash": "182448549340161274143776333624735897750"
},
"target": {
"function": "flow_offload_route_init",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558b00a30e05753a62ecc7e05e939ca8f0241148",
"id": "CVE-2024-27403-a8c66078",
"signature_type": "Function"
},
{
"digest": {
"length": 209.0,
"function_hash": "182448549340161274143776333624735897750"
},
"target": {
"function": "flow_offload_route_init",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@012df10717da02367aaf92c65f9c89db206c15f4",
"id": "CVE-2024-27403-ad4fb64c",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"4250437117098366649221834395383671759",
"313281559949318056948119098523474319520",
"235892331336681489917154185590474994128",
"95323144025200954508236587138587187090"
],
"threshold": 0.9
},
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@012df10717da02367aaf92c65f9c89db206c15f4",
"id": "CVE-2024-27403-b60476f7",
"signature_type": "Line"
},
{
"digest": {
"length": 1511.0,
"function_hash": "119691038753177205877027338850703189350"
},
"target": {
"function": "flow_offload_fill_route",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e0f0430389be7696396c62f037be4bf72cf93e3",
"id": "CVE-2024-27403-c4f7ae25",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"85413158487071431983359407450988760339",
"151849709998637601216535688733515398118",
"298076482626880251000106949719315968763",
"203455904139779229144160563807570345967",
"66300613569759129224772007382574878286",
"245383150315700702430295672563419414650",
"298420927001963055762480306157996413696",
"184098562393235508355272194895861068566",
"16108937004529224198027684271483600481",
"319240984148499666357463427765224740930",
"86491646890737387300064813996079706701",
"258641331174757958380533901624786526946",
"237415130339402078785918805195260802823"
],
"threshold": 0.9
},
"target": {
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558b00a30e05753a62ecc7e05e939ca8f0241148",
"id": "CVE-2024-27403-d667afd6",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"150954661777874895287277337809173065382",
"313281559949318056948119098523474319520",
"235892331336681489917154185590474994128",
"163187335654723075898631416909773533689"
],
"threshold": 0.9
},
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c",
"id": "CVE-2024-27403-e2560f74",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"85413158487071431983359407450988760339",
"151849709998637601216535688733515398118",
"298076482626880251000106949719315968763",
"203455904139779229144160563807570345967",
"66300613569759129224772007382574878286",
"245383150315700702430295672563419414650",
"298420927001963055762480306157996413696",
"184098562393235508355272194895861068566",
"16108937004529224198027684271483600481",
"319240984148499666357463427765224740930",
"86491646890737387300064813996079706701",
"258641331174757958380533901624786526946",
"237415130339402078785918805195260802823"
],
"threshold": 0.9
},
"target": {
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e0f0430389be7696396c62f037be4bf72cf93e3",
"id": "CVE-2024-27403-ea3563b6",
"signature_type": "Line"
},
{
"digest": {
"length": 209.0,
"function_hash": "182448549340161274143776333624735897750"
},
"target": {
"function": "flow_offload_route_init",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@670548c8db44d76e40e1dfc06812bca36a61e9ae",
"id": "CVE-2024-27403-ea602ac9",
"signature_type": "Function"
},
{
"digest": {
"length": 209.0,
"function_hash": "182448549340161274143776333624735897750"
},
"target": {
"function": "flow_offload_route_init",
"file": "net/netfilter/nf_flow_table_core.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c",
"id": "CVE-2024-27403-f87538bb",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"4250437117098366649221834395383671759",
"313281559949318056948119098523474319520",
"235892331336681489917154185590474994128",
"95323144025200954508236587138587187090"
],
"threshold": 0.9
},
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e0f0430389be7696396c62f037be4bf72cf93e3",
"id": "CVE-2024-27403-fbf541a6",
"signature_type": "Line"
}
]