CVE-2024-57947
📋 TL;DR
A memory initialization flaw in the Linux kernel's netfilter pipapo set implementation allows incorrect matching results when processing network filter rules. This affects Linux systems using nftables with specific set configurations where the first field size isn't the largest. The vulnerability could lead to incorrect packet filtering decisions.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Incorrect firewall rule matching could allow unauthorized network traffic to bypass intended restrictions, potentially enabling network-based attacks or data exfiltration.
Likely Case
Inconsistent packet filtering behavior causing either unintended traffic blocking or unintended traffic allowance depending on specific nftables configuration.
If Mitigated
Minimal impact if proper network segmentation and defense-in-depth controls are implemented alongside nftables filtering.
🎯 Exploit Status
Exploitation requires specific nftables configuration and understanding of pipapo set implementation. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel trees (commits: 69b6a67f7052, 77bf0c4ab928, 791a615b7ad2, 8058c88ac0df, 957a4d1c4c58)
Vendor Advisory: https://git.kernel.org/stable/c/69b6a67f7052905e928d75a0c5871de50e686986
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable affected nftables configurations
linuxAvoid using nftables pipapo sets where first field size is not the largest field size
Review nftables rules for pipapo set usage
Modify rules to avoid vulnerable configurations
🧯 If You Can't Patch
- Review and audit all nftables configurations for pipapo set usage patterns
- Implement additional network security controls (IDS/IPS, segmentation) to compensate for potential filtering inconsistencies
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if using nftables with pipapo sets where first field size differs from largest field sizeCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes one of the patch commits and test nftables functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected nftables rule matches
- Kernel oops or warnings related to netfilter
Network Indicators:
- Unexpected network traffic patterns that should be blocked by firewall rules
SIEM Query:
Search for kernel logs containing 'netfilter' or 'nf_set_pipapo' errors🔗 References
- https://git.kernel.org/stable/c/69b6a67f7052905e928d75a0c5871de50e686986
- https://git.kernel.org/stable/c/77bf0c4ab928ca4c9a99311f4f70ba0c17fecba9
- https://git.kernel.org/stable/c/791a615b7ad2258c560f91852be54b0480837c93
- https://git.kernel.org/stable/c/8058c88ac0df21239daee54b5934d5c80ca9685f
- https://git.kernel.org/stable/c/957a4d1c4c5849e4515c9fb4db21bf85318103dc
- https://git.kernel.org/stable/c/9625c46ce6fd4f922595a4b32b1de5066d70464f
