CVE-2024-42269

netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user space before the entry is allocated via register_pernet_subsys(). Let's call register_pernet_subsys() before xt_register_template().

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.04%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/419ee6274c5153b89c4393c1946faa4c3cad4f9e patch
https://git.kernel.org/stable/c/91b6df6611b7edb28676c4f63f90c56c30d3e601 patch
https://git.kernel.org/stable/c/e85b9b6a87be4cb3710082038b677e97f2389003 patch
https://git.kernel.org/stable/c/87dba44e9471b79b255d0736858a897332db9226 patch
https://git.kernel.org/stable/c/c22921df777de5606f1047b1345b8d22ef1c0b34 patch

Frequently Asked Questions

What is the severity of CVE-2024-42269?
CVE-2024-42269 has been scored as a medium severity vulnerability.
How to fix CVE-2024-42269?
To fix CVE-2024-42269, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-42269 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-42269 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-42269?
CVE-2024-42269 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.