Vulnerability identifier: #VU91669

Vulnerability risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27403

CWE-ID: CWE-191

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the flow_offload_dst_cookie() and nft_flow_dst_release() functions in net/netfilter/nf_flow_table_core.c. A local user can execute arbitrary code.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c
http://git.kernel.org/stable/c/012df10717da02367aaf92c65f9c89db206c15f4
http://git.kernel.org/stable/c/558b00a30e05753a62ecc7e05e939ca8f0241148
http://git.kernel.org/stable/c/670548c8db44d76e40e1dfc06812bca36a61e9ae
http://git.kernel.org/stable/c/9e0f0430389be7696396c62f037be4bf72cf93e3

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.