CVE-2024-26609 - Vulnerability Details

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Published: 2024-02-29

Score: 5.5 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.rt7.342.el8_10	cpe:/a:redhat:enterprise_linux:8::nfv	RHSA-2024:2950	2024-05-22T00:00:00Z
kernel-0:4.18.0-553.el8_10	cpe:/o:redhat:enterprise_linux:8	RHSA-2024:3138	2024-05-22T00:00:00Z
Red Hat Enterprise Linux 9
kernel-0:5.14.0-427.13.1.el9_4	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:2394	2024-04-30T00:00:00Z
kernel-0:5.14.0-427.13.1.el9_4	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:2394	2024-04-30T00:00:00Z

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-41-lee@kernel.org/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26609
https://www.cve.org/CVERecord?id=CVE-2024-26609

History

No history.

Subscriptions

Redhat Enterprise Linux

MITRE

Status: REJECTED

Assigner: Linux

Published: 2024-02-29T15:52:15.228Z

Updated: 2024-03-12T13:57:07.595Z

Reserved: 2024-02-19T14:20:24.130Z

Link: CVE-2024-26609

Vulnrichment

Updated:

NVD

Status : Rejected

Published: 2024-03-11T18:15:19.010

Modified: 2024-03-12T14:15:07.133

Link: CVE-2024-26609

Redhat

Severity : Moderate

Publid Date: 2024-02-29T00:00:00Z

Links: CVE-2024-26609 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-416
Use After Free

{"affected_release": [{"advisory": "RHSA-2024:2950", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.rt7.342.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:3138", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:2394", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.13.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}, {"advisory": "RHSA-2024:2394", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.13.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters", "id": "2269217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269217"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["[REJECTED CVE] An issue was identified in the Linux kernel's netfilter subsystem related to nf_tables. The issue occurs when a positive value, such as NF_ACCEPT, is provided in the upper 16 bits of NF_DROP verdict parameters, which are expected to contain valid errno values (e.g., -EPERM). This improper input handling could lead to memory corruption, potentially allowing attackers to exploit the system."], "name": "CVE-2024-26609", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26609\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26609\nhttps://lore.kernel.org/linux-cve-announce/20240229155245.1571576-41-lee@kernel.org/T"], "statement": "This CVE has been rejected upstream:- https://lore.kernel.org/linux-cve-announce/20240312135714.1522772-2-lee@kernel.org/", "threat_severity": "Moderate"}

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object