CVE-2024-41042

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41042
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace).

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f Patch
https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b Patch
https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0 Patch
https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e Patch
https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae Patch
https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe Patch
https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24 Patch
https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c Patch
https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae Patch
https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*
History

25 Sep 2025, 20:04

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f - () https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f - Patch
References () https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b - () https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b - Patch
References () https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0 - () https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0 - Patch
References () https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e - () https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e - Patch
References () https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae - () https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae - Patch
References () https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe - () https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe - Patch
References () https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24 - () https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24 - Patch
References () https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c - () https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c - Patch

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae - () https://git.kernel.org/stable/c/9df785aeb7dcc8efd1d4110bb27d26005298ebae -
References () https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c - () https://git.kernel.org/stable/c/cff3bd012a9512ac5ed858d38e6ed65f6391008c -

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f -
  • () https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b -
  • () https://git.kernel.org/stable/c/8246b7466c8da49d0d9e85e26cbd69dd6d3e3d1e -
  • () https://git.kernel.org/stable/c/cd4348e0a50286282c314ad6d2b0740e7c812c24 -

14 Aug 2024, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0 -
  • () https://git.kernel.org/stable/c/b6b6e430470e1c3c5513311cb35a15a205595abe -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_tables: prefiere nft_chain_validate nft_chain_validate ya realiza detección de bucle porque un ciclo resultará en un desbordamiento de la pila de llamadas (ctx->level >= NFT_JUMP_STACK_SIZE). También sigue los mapas a través de ->validate callback en nft_lookup, por lo que no parece haber razón para iterar los mapas nuevamente. nf_tables_check_loops() y todas sus funciones auxiliares se pueden eliminar. Esto mejora significativamente el tiempo de carga del conjunto de reglas, de 23 a 12 segundos. Esto también corrige un error de bloqueo. El código de detección de bucle antiguo puede provocar una recursividad ilimitada: ERROR: La página de protección de pila de TAREA fue visitada en... Vaya: página de protección de pila: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft No contaminado 6.10. 0-rc5+ #1 [..] con un conjunto de reglas adecuado durante la validación de los almacenes de registros. No veo ninguna razón real para intentar verificar esto desde nft_validate_register_store(); en este punto, la transacción aún está en progreso, por lo que no tenemos una imagen completa del gráfico de reglas. Para nf-next, podría tener sentido eliminarlo o hacer que esto dependa de table->validate_state en caso de que podamos detectar un error antes (para mejorar el informe de errores al espacio de usuario).

29 Jul 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-29 15:15

Updated : 2025-09-25 20:04

NVD link : CVE-2024-41042

Mitre link : CVE-2024-41042

CVE.ORG link : CVE-2024-41042

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write