CVE-2024-27017

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27017", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.209Z", "datePublished": "2024-05-01T05:30:01.888Z", "dateUpdated": "2026-08-05T11:29:00.212Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:00.212Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\n\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\n\nBased on patch from Florian Westphal."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the nfnetlink/nftables netlink socket (NFT_MSG_GETSETELEM dump raced against transaction commit/abort), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues repeated set-element dumps while another repeatedly commits/aborts transactions to flip the gencursor and free priv->clone \u2014 and can retry indefinitely; once the wrong branch is latched the free window spans the entire element walk.\nPR:L - nfnetlink_rcv_msg() only requires CAP_NET_ADMIN via netlink_net_capable(), which an unprivileged user obtains in their own network namespace with `unshare -Urn`, where they can freely create pipapo sets and drive both the dump and the transaction.\nUI:N - Exploitation is entirely driven by the attacker's own netlink threads; no action by any other user or administrator is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority, giving kernel-level compromise rather than crossing a hypervisor, IOMMU, or other scope boundary.\nC:H - The walk reads element pointers and contents from freed memory and copies them straight into the netlink dump reply (nft_data_dump of key/data, plus nla_put of udata->len bytes at udata->data), giving a groomable arbitrary kernel-memory read exfiltrated directly to userspace.\nI:H - The element pointer `e` is taken from the freed mt array, so after heap reallocation the attacker controls it, and nf_tables_fill_expr_info() performs an indirect call via `expr->ops->dump()` on that object \u2014 a control-flow hijack primitive enabling privilege escalation.\nA:H - Even without successful exploitation, dereferencing freed/reallocated pipapo match data and wild element pointers produces an oops or panic, and the race can be re-triggered at will to crash the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "versions": [{"version": "2a90da8e0dd50f42e577988f4219f4f4cd3616b7", "lessThan": "ff89db14c63a827066446460e39226c0688ef786", "status": "affected", "versionType": "git"}, {"version": "45eb6944d0f55102229115de040ef3a48841434a", "lessThan": "ce9fef54c5ec9912a0c9a47bac3195cc41b14679", "status": "affected", "versionType": "git"}, {"version": "0d836f917520300a8725a5dbdad4406438d0cead", "lessThan": "52735a010f37580b3a569a996f878fdd87425650", "status": "affected", "versionType": "git"}, {"version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "f24d8abc2bb8cbf31ec713336e402eafa8f42f60", "status": "affected", "versionType": "git"}, {"version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "721715655c72640567e8742567520c99801148ed", "status": "affected", "versionType": "git"}, {"version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "29b359cf6d95fd60730533f7f10464e95bd17c73", "status": "affected", "versionType": "git"}, {"version": "f661383b5f1aaac3fe121b91e04332944bc90193", "status": "affected", "versionType": "git"}, {"version": "5.10.186", "lessThan": "5.10.227", "status": "affected", "versionType": "semver"}, {"version": "5.15.119", "lessThan": "5.15.168", "status": "affected", "versionType": "semver"}, {"version": "6.1.36", "lessThan": "6.1.112", "status": "affected", "versionType": "semver"}, {"version": "6.3.10", "lessThan": "6.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.112", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.53", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.186", "versionEndExcluding": "5.10.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.119", "versionEndExcluding": "5.15.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.36", "versionEndExcluding": "6.1.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786"}, {"url": "https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679"}, {"url": "https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650"}, {"url": "https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60"}, {"url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"}, {"url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"}], "title": "netfilter: nft_set_pipapo: walk over current view on netlink dump", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T16:20:37.656440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:29.908Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:17:24.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:17:24.217Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T16:20:37.656440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T16:20:44.217Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "netfilter: nft_set_pipapo: walk over current view on netlink dump", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the nfnetlink/nftables netlink socket (NFT_MSG_GETSETELEM dump raced against transaction commit/abort), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues repeated set-element dumps while another repeatedly commits/aborts transactions to flip the gencursor and free priv->clone \u2014 and can retry indefinitely; once the wrong branch is latched the free window spans the entire element walk.\nPR:L - nfnetlink_rcv_msg() only requires CAP_NET_ADMIN via netlink_net_capable(), which an unprivileged user obtains in their own network namespace with `unshare -Urn`, where they can freely create pipapo sets and drive both the dump and the transaction.\nUI:N - Exploitation is entirely driven by the attacker's own netlink threads; no action by any other user or administrator is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority, giving kernel-level compromise rather than crossing a hypervisor, IOMMU, or other scope boundary.\nC:H - The walk reads element pointers and contents from freed memory and copies them straight into the netlink dump reply (nft_data_dump of key/data, plus nla_put of udata->len bytes at udata->data), giving a groomable arbitrary kernel-memory read exfiltrated directly to userspace.\nI:H - The element pointer `e` is taken from the freed mt array, so after heap reallocation the attacker controls it, and nf_tables_fill_expr_info() performs an indirect call via `expr->ops->dump()` on that object \u2014 a control-flow hijack primitive enabling privilege escalation.\nA:H - Even without successful exploitation, dereferencing freed/reallocated pipapo match data and wild element pointers produces an oops or panic, and the race can be re-triggered at will to crash the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2a90da8e0dd50f42e577988f4219f4f4cd3616b7", "lessThan": "ff89db14c63a827066446460e39226c0688ef786", "versionType": "git"}, {"status": "affected", "version": "45eb6944d0f55102229115de040ef3a48841434a", "lessThan": "ce9fef54c5ec9912a0c9a47bac3195cc41b14679", "versionType": "git"}, {"status": "affected", "version": "0d836f917520300a8725a5dbdad4406438d0cead", "lessThan": "52735a010f37580b3a569a996f878fdd87425650", "versionType": "git"}, {"status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "f24d8abc2bb8cbf31ec713336e402eafa8f42f60", "versionType": "git"}, {"status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "721715655c72640567e8742567520c99801148ed", "versionType": "git"}, {"status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "lessThan": "29b359cf6d95fd60730533f7f10464e95bd17c73", "versionType": "git"}, {"status": "affected", "version": "f661383b5f1aaac3fe121b91e04332944bc90193", "versionType": "git"}, {"status": "affected", "version": "5.10.186", "lessThan": "5.10.227", "versionType": "semver"}, {"status": "affected", "version": "5.15.119", "lessThan": "5.15.168", "versionType": "semver"}, {"status": "affected", "version": "6.1.36", "lessThan": "6.1.112", "versionType": "semver"}, {"status": "affected", "version": "6.3.10", "lessThan": "6.4", "versionType": "semver"}], "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.227", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.168", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.112", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.53", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.8", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786"}, {"url": "https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679"}, {"url": "https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650"}, {"url": "https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60"}, {"url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"}, {"url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\n\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\n\nBased on patch from Florian Westphal."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.227", "versionStartIncluding": "5.10.186"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.15.119"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.112", "versionStartIncluding": "6.1.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.53", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.8", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.3.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:00.212Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27017", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:29:00.212Z", "dateReserved": "2024-02-19T14:20:24.209Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T05:30:01.888Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ff89db14c63a827066446460e39226c0688ef786", "status": "affected", "version": "2a90da8e0dd50f42e577988f4219f4f4cd3616b7", "versionType": "git"}, {"lessThan": "ce9fef54c5ec9912a0c9a47bac3195cc41b14679", "status": "affected", "version": "45eb6944d0f55102229115de040ef3a48841434a", "versionType": "git"}, {"lessThan": "52735a010f37580b3a569a996f878fdd87425650", "status": "affected", "version": "0d836f917520300a8725a5dbdad4406438d0cead", "versionType": "git"}, {"lessThan": "f24d8abc2bb8cbf31ec713336e402eafa8f42f60", "status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "versionType": "git"}, {"lessThan": "721715655c72640567e8742567520c99801148ed", "status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "versionType": "git"}, {"lessThan": "29b359cf6d95fd60730533f7f10464e95bd17c73", "status": "affected", "version": "2b84e215f87443c74ac0aa7f76bb172d43a87033", "versionType": "git"}, {"status": "affected", "version": "f661383b5f1aaac3fe121b91e04332944bc90193", "versionType": "git"}, {"lessThan": "5.10.227", "status": "affected", "version": "5.10.186", "versionType": "semver"}, {"lessThan": "5.15.168", "status": "affected", "version": "5.15.119", "versionType": "semver"}, {"lessThan": "6.1.112", "status": "affected", "version": "6.1.36", "versionType": "semver"}, {"lessThan": "6.4", "status": "affected", "version": "6.3.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_pipapo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.112", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.53", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABBE8A9C-EB49-4236-B78E-D0771D521A7F", "versionEndExcluding": "6.8.8", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*", "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\n\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\n\nBased on patch from Florian Westphal."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: recorra la vista actual en el volcado de netlink. La m\u00e1scara de generaci\u00f3n se puede actualizar mientras el volcado de netlink est\u00e1 en progreso. El iterador de recorrido backend del conjunto pipapo no puede confiar en \u00e9l para inferir qu\u00e9 vista de la estructura de datos se va a utilizar. Agregue notaci\u00f3n para especificar si el usuario desea leer/actualizar el conjunto. Basado en un parche de Florian Westphal."}], "id": "CVE-2024-27017", "lastModified": "2026-08-04T11:17:33.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27017", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-28T16:20:37.656440Z", "version": "2.0.3"}}]}, "published": "2024-05-01T06:15:20.483", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52735a010f37580b3a569a996f878fdd87425650"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce9fef54c5ec9912a0c9a47bac3195cc41b14679"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f24d8abc2bb8cbf31ec713336e402eafa8f42f60"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff89db14c63a827066446460e39226c0688ef786"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29b359cf6d95fd60730533f7f10464e95bd17c73"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/721715655c72640567e8742567520c99801148ed"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:8870", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.27.1.rt7.368.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-11-05T00:00:00Z"}, {"advisory": "RHSA-2024:8856", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.27.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-11-05T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2025:1658", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.55.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-02-19T00:00:00Z"}], "bugzilla": {"description": "kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump", "id": "2278262", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278262"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nft_set_pipapo: walk over current view on netlink dump\nThe generation mask can be updated while netlink dump is in progress.\nThe pipapo set backend walk iterator cannot rely on it to infer what\nview of the datastructure is to be used. Add notation to specify if user\nwants to read/update the set.\nBased on patch from Florian Westphal."], "name": "CVE-2024-27017", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27017\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27017\nhttps://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27017-d867@gregkh/T"], "threat_severity": "Low"}

{}