Race condition within a thread in Linux kernel netfilter

1) Race condition within a thread

EUVDB-ID: #VU91431

Risk: Low

CVSSv3.1: 4.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27019

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a data race within the __nft_obj_type_get() and nft_obj_type_get() functions in net/netfilter/nf_tables_api.c. A local user can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/379bf7257bc5f2a1b1ca8514e08a871b7bf6d920
http://git.kernel.org/stable/c/df7c0fb8c2b9f9cac65659332581b19682a71349
http://git.kernel.org/stable/c/ad333578f736d56920e090d7db1f8dec891d815e
http://git.kernel.org/stable/c/4ca946b19caf655a08d5e2266d4d5526025ebb73
http://git.kernel.org/stable/c/d78d867dcea69c328db30df665be5be7d0148484

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.