CVE-2024-26642

netfilter: nf_tables: disallow anonymous set with timeout flag

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.01%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9	patch
https://git.kernel.org/stable/c/e9a0d3f376eb356d54ffce36e7cc37514cbfbd6f	patch
https://git.kernel.org/stable/c/fe40ffbca19dc70d7c6b1e3c77b9ccb404c57351	patch
https://git.kernel.org/stable/c/7cdc1be24cc1bcd56a3e89ac4aef20e31ad09199	patch
https://git.kernel.org/stable/c/72c1efe3f247a581667b7d368fff3bd9a03cd57a	patch
https://git.kernel.org/stable/c/c0c2176d1814b92ea4c8e7eb7c9cd94cd99c1b12	patch
https://git.kernel.org/stable/c/8e07c16695583a66e81f67ce4c46e94dece47ba7	patch
https://git.kernel.org/stable/c/16603605b667b70da974bea8216c93e7db043bf1	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	mailing list
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html	mailing list

Frequently Asked Questions

What is the severity of CVE-2024-26642?: CVE-2024-26642 has been scored as a medium severity vulnerability.
How to fix CVE-2024-26642?: To fix CVE-2024-26642, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-26642 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-26642 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-26642?: CVE-2024-26642 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.