CVE-2024-50038 (GCVE-0-2024-50038)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-05-11 20:44
VLAI
Title
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid NFPROTO_UNSPEC where needed syzbot managed to call xt_cluster match via ebtables: WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only. Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables. Check all UNSPEC matches and targets for similar issues: - matches and targets are fine except if they assume skb_network_header() is valid -- this is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area. - targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE. Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables. The MARK target is also used by arptables, so register for NFPROTO_ARP too. While at it, bail out if connbytes fails to enable the corresponding conntrack family. This change passes the selftests in iptables.git.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0269ea4937343536ec7e85649932bc8c9686ea78 , < 85ff9a0f793ca52c527e75cd40a69c948627ebde (git)
Affected: 0269ea4937343536ec7e85649932bc8c9686ea78 , < 8f482bb7e27b37f1f734bb9a8eeb28b23d59d189 (git)
Affected: 0269ea4937343536ec7e85649932bc8c9686ea78 , < 997f67d813ce0cf5eb3cdb8f124da68141e91b6c (git)
Affected: 0269ea4937343536ec7e85649932bc8c9686ea78 , < 4cdc55ec6222bb195995cc58f7cb46e4d8907056 (git)
Affected: 0269ea4937343536ec7e85649932bc8c9686ea78 , < 0bfcb7b71e735560077a42847f69597ec7dcc326 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:25:10.359959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:44.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:43.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_CHECKSUM.c",
            "net/netfilter/xt_CLASSIFY.c",
            "net/netfilter/xt_CONNSECMARK.c",
            "net/netfilter/xt_CT.c",
            "net/netfilter/xt_IDLETIMER.c",
            "net/netfilter/xt_LED.c",
            "net/netfilter/xt_NFLOG.c",
            "net/netfilter/xt_RATEEST.c",
            "net/netfilter/xt_SECMARK.c",
            "net/netfilter/xt_TRACE.c",
            "net/netfilter/xt_addrtype.c",
            "net/netfilter/xt_cluster.c",
            "net/netfilter/xt_connbytes.c",
            "net/netfilter/xt_connlimit.c",
            "net/netfilter/xt_connmark.c",
            "net/netfilter/xt_mark.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "85ff9a0f793ca52c527e75cd40a69c948627ebde",
              "status": "affected",
              "version": "0269ea4937343536ec7e85649932bc8c9686ea78",
              "versionType": "git"
            },
            {
              "lessThan": "8f482bb7e27b37f1f734bb9a8eeb28b23d59d189",
              "status": "affected",
              "version": "0269ea4937343536ec7e85649932bc8c9686ea78",
              "versionType": "git"
            },
            {
              "lessThan": "997f67d813ce0cf5eb3cdb8f124da68141e91b6c",
              "status": "affected",
              "version": "0269ea4937343536ec7e85649932bc8c9686ea78",
              "versionType": "git"
            },
            {
              "lessThan": "4cdc55ec6222bb195995cc58f7cb46e4d8907056",
              "status": "affected",
              "version": "0269ea4937343536ec7e85649932bc8c9686ea78",
              "versionType": "git"
            },
            {
              "lessThan": "0bfcb7b71e735560077a42847f69597ec7dcc326",
              "status": "affected",
              "version": "0269ea4937343536ec7e85649932bc8c9686ea78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_CHECKSUM.c",
            "net/netfilter/xt_CLASSIFY.c",
            "net/netfilter/xt_CONNSECMARK.c",
            "net/netfilter/xt_CT.c",
            "net/netfilter/xt_IDLETIMER.c",
            "net/netfilter/xt_LED.c",
            "net/netfilter/xt_NFLOG.c",
            "net/netfilter/xt_RATEEST.c",
            "net/netfilter/xt_SECMARK.c",
            "net/netfilter/xt_TRACE.c",
            "net/netfilter/xt_addrtype.c",
            "net/netfilter/xt_cluster.c",
            "net/netfilter/xt_connbytes.c",
            "net/netfilter/xt_connlimit.c",
            "net/netfilter/xt_connmark.c",
            "net/netfilter/xt_mark.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\n\nsyzbot managed to call xt_cluster match via ebtables:\n\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\n [..]\n ebt_do_table+0x174b/0x2a40\n\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\nprocessing.  As this is only useful to restrict locally terminating\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\n\nPablo points out that this is a general issue, direct users of the\nset/getsockopt interface can call into targets/matches that were only\nintended for use with ip(6)tables.\n\nCheck all UNSPEC matches and targets for similar issues:\n\n- matches and targets are fine except if they assume skb_network_header()\n  is valid -- this is only true when called from inet layer: ip(6) stack\n  pulls the ip/ipv6 header into linear data area.\n- targets that return XT_CONTINUE or other xtables verdicts must be\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\n\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\nthey are provided for use by ip(6)tables.\n\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\n\nWhile at it, bail out if connbytes fails to enable the corresponding\nconntrack family.\n\nThis change passes the selftests in iptables.git."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:44:17.484Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/85ff9a0f793ca52c527e75cd40a69c948627ebde"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f482bb7e27b37f1f734bb9a8eeb28b23d59d189"
        },
        {
          "url": "https://git.kernel.org/stable/c/997f67d813ce0cf5eb3cdb8f124da68141e91b6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cdc55ec6222bb195995cc58f7cb46e4d8907056"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bfcb7b71e735560077a42847f69597ec7dcc326"
        }
      ],
      "title": "netfilter: xtables: avoid NFPROTO_UNSPEC where needed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50038",
    "datePublished": "2024-10-21T19:39:38.451Z",
    "dateReserved": "2024-10-21T12:17:06.070Z",
    "dateUpdated": "2026-05-11T20:44:17.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50038",
      "date": "2026-05-26",
      "epss": "0.00012",
      "percentile": "0.01946"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.30\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"B7B7108B-7220-433F-A168-6ECF9D7F65F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.57\", \"matchCriteriaId\": \"05D83DB8-7465-4F88-AFB2-980011992AC1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.4\", \"matchCriteriaId\": \"AA84D336-CE9A-4535-B901-1AD77EC17C34\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\\n\\nsyzbot managed to call xt_cluster match via ebtables:\\n\\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\\n [..]\\n ebt_do_table+0x174b/0x2a40\\n\\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\\nprocessing.  As this is only useful to restrict locally terminating\\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\\n\\nPablo points out that this is a general issue, direct users of the\\nset/getsockopt interface can call into targets/matches that were only\\nintended for use with ip(6)tables.\\n\\nCheck all UNSPEC matches and targets for similar issues:\\n\\n- matches and targets are fine except if they assume skb_network_header()\\n  is valid -- this is only true when called from inet layer: ip(6) stack\\n  pulls the ip/ipv6 header into linear data area.\\n- targets that return XT_CONTINUE or other xtables verdicts must be\\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\\n\\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\\nthey are provided for use by ip(6)tables.\\n\\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\\n\\nWhile at it, bail out if connbytes fails to enable the corresponding\\nconntrack family.\\n\\nThis change passes the selftests in iptables.git.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: xtables: evita NFPROTO_UNSPEC donde sea necesario syzbot logr\\u00f3 llamar a xt_cluster match a trav\\u00e9s de ebtables: ADVERTENCIA: CPU: 0 PID: 11 en net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 El m\\u00f3dulo se registra en NFPROTO_UNSPEC, pero asume el procesamiento de paquetes ipv4/ipv6. Como esto solo es \\u00fatil para restringir el tr\\u00e1fico TCP/UDP que termina localmente, reg\\u00edstrelo solo para la familia ipv4 e ipv6. Pablo se\\u00f1ala que este es un problema general, los usuarios directos de la interfaz set/getsockopt pueden llamar a destinos/coincidencias que solo estaban destinados a usarse con tablas ip(6). Compruebe todas las coincidencias y objetivos UNSPEC para ver si hay problemas similares: - las coincidencias y los objetivos est\\u00e1n bien excepto si asumen que skb_network_header() es v\\u00e1lido - esto solo es cierto cuando se llama desde la capa inet: la pila ip(6) extrae el encabezado ip/ipv6 en el \\u00e1rea de datos lineales. - los objetivos que devuelven XT_CONTINUE u otros veredictos de xtables tambi\\u00e9n deben restringirse, son incompatibles con el traverser de ebtables, por ejemplo, EBT_CONTINUE es un valor completamente diferente de XT_CONTINUE. La mayor\\u00eda de las coincidencias/objetivos se cambian para registrarse para NFPROTO_IPV4/IPV6, ya que se proporcionan para su uso por ip(6)tables. El objetivo MARK tambi\\u00e9n lo usan arptables, as\\u00ed que reg\\u00edstrese tambi\\u00e9n para NFPROTO_ARP. Mientras tanto, abandone si connbytes no puede habilitar la familia conntrack correspondiente. Este cambio pasa las autopruebas en iptables.git.\"}]",
      "id": "CVE-2024-50038",
      "lastModified": "2024-10-25T15:45:51.340",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:16.877",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0bfcb7b71e735560077a42847f69597ec7dcc326\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4cdc55ec6222bb195995cc58f7cb46e4d8907056\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/85ff9a0f793ca52c527e75cd40a69c948627ebde\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8f482bb7e27b37f1f734bb9a8eeb28b23d59d189\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/997f67d813ce0cf5eb3cdb8f124da68141e91b6c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50038\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:16.877\",\"lastModified\":\"2025-11-03T23:16:42.523\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\\n\\nsyzbot managed to call xt_cluster match via ebtables:\\n\\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\\n [..]\\n ebt_do_table+0x174b/0x2a40\\n\\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\\nprocessing.  As this is only useful to restrict locally terminating\\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\\n\\nPablo points out that this is a general issue, direct users of the\\nset/getsockopt interface can call into targets/matches that were only\\nintended for use with ip(6)tables.\\n\\nCheck all UNSPEC matches and targets for similar issues:\\n\\n- matches and targets are fine except if they assume skb_network_header()\\n  is valid -- this is only true when called from inet layer: ip(6) stack\\n  pulls the ip/ipv6 header into linear data area.\\n- targets that return XT_CONTINUE or other xtables verdicts must be\\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\\n\\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\\nthey are provided for use by ip(6)tables.\\n\\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\\n\\nWhile at it, bail out if connbytes fails to enable the corresponding\\nconntrack family.\\n\\nThis change passes the selftests in iptables.git.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: xtables: evita NFPROTO_UNSPEC donde sea necesario syzbot logr\u00f3 llamar a xt_cluster match a trav\u00e9s de ebtables: ADVERTENCIA: CPU: 0 PID: 11 en net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 El m\u00f3dulo se registra en NFPROTO_UNSPEC, pero asume el procesamiento de paquetes ipv4/ipv6. Como esto solo es \u00fatil para restringir el tr\u00e1fico TCP/UDP que termina localmente, reg\u00edstrelo solo para la familia ipv4 e ipv6. Pablo se\u00f1ala que este es un problema general, los usuarios directos de la interfaz set/getsockopt pueden llamar a destinos/coincidencias que solo estaban destinados a usarse con tablas ip(6). Compruebe todas las coincidencias y objetivos UNSPEC para ver si hay problemas similares: - las coincidencias y los objetivos est\u00e1n bien excepto si asumen que skb_network_header() es v\u00e1lido - esto solo es cierto cuando se llama desde la capa inet: la pila ip(6) extrae el encabezado ip/ipv6 en el \u00e1rea de datos lineales. - los objetivos que devuelven XT_CONTINUE u otros veredictos de xtables tambi\u00e9n deben restringirse, son incompatibles con el traverser de ebtables, por ejemplo, EBT_CONTINUE es un valor completamente diferente de XT_CONTINUE. La mayor\u00eda de las coincidencias/objetivos se cambian para registrarse para NFPROTO_IPV4/IPV6, ya que se proporcionan para su uso por ip(6)tables. El objetivo MARK tambi\u00e9n lo usan arptables, as\u00ed que reg\u00edstrese tambi\u00e9n para NFPROTO_ARP. Mientras tanto, abandone si connbytes no puede habilitar la familia conntrack correspondiente. Este cambio pasa las autopruebas en iptables.git.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.30\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"B7B7108B-7220-433F-A168-6ECF9D7F65F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.57\",\"matchCriteriaId\":\"05D83DB8-7465-4F88-AFB2-980011992AC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"AA84D336-CE9A-4535-B901-1AD77EC17C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bfcb7b71e735560077a42847f69597ec7dcc326\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cdc55ec6222bb195995cc58f7cb46e4d8907056\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85ff9a0f793ca52c527e75cd40a69c948627ebde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f482bb7e27b37f1f734bb9a8eeb28b23d59d189\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/997f67d813ce0cf5eb3cdb8f124da68141e91b6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:43.902Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50038\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:25:10.359959Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:25:13.522Z\"}}], \"cna\": {\"title\": \"netfilter: xtables: avoid NFPROTO_UNSPEC where needed\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0269ea4937343536ec7e85649932bc8c9686ea78\", \"lessThan\": \"85ff9a0f793ca52c527e75cd40a69c948627ebde\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0269ea4937343536ec7e85649932bc8c9686ea78\", \"lessThan\": \"8f482bb7e27b37f1f734bb9a8eeb28b23d59d189\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0269ea4937343536ec7e85649932bc8c9686ea78\", \"lessThan\": \"997f67d813ce0cf5eb3cdb8f124da68141e91b6c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0269ea4937343536ec7e85649932bc8c9686ea78\", \"lessThan\": \"4cdc55ec6222bb195995cc58f7cb46e4d8907056\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0269ea4937343536ec7e85649932bc8c9686ea78\", \"lessThan\": \"0bfcb7b71e735560077a42847f69597ec7dcc326\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/xt_CHECKSUM.c\", \"net/netfilter/xt_CLASSIFY.c\", \"net/netfilter/xt_CONNSECMARK.c\", \"net/netfilter/xt_CT.c\", \"net/netfilter/xt_IDLETIMER.c\", \"net/netfilter/xt_LED.c\", \"net/netfilter/xt_NFLOG.c\", \"net/netfilter/xt_RATEEST.c\", \"net/netfilter/xt_SECMARK.c\", \"net/netfilter/xt_TRACE.c\", \"net/netfilter/xt_addrtype.c\", \"net/netfilter/xt_cluster.c\", \"net/netfilter/xt_connbytes.c\", \"net/netfilter/xt_connlimit.c\", \"net/netfilter/xt_connmark.c\", \"net/netfilter/xt_mark.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/xt_CHECKSUM.c\", \"net/netfilter/xt_CLASSIFY.c\", \"net/netfilter/xt_CONNSECMARK.c\", \"net/netfilter/xt_CT.c\", \"net/netfilter/xt_IDLETIMER.c\", \"net/netfilter/xt_LED.c\", \"net/netfilter/xt_NFLOG.c\", \"net/netfilter/xt_RATEEST.c\", \"net/netfilter/xt_SECMARK.c\", \"net/netfilter/xt_TRACE.c\", \"net/netfilter/xt_addrtype.c\", \"net/netfilter/xt_cluster.c\", \"net/netfilter/xt_connbytes.c\", \"net/netfilter/xt_connlimit.c\", \"net/netfilter/xt_connmark.c\", \"net/netfilter/xt_mark.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/85ff9a0f793ca52c527e75cd40a69c948627ebde\"}, {\"url\": \"https://git.kernel.org/stable/c/8f482bb7e27b37f1f734bb9a8eeb28b23d59d189\"}, {\"url\": \"https://git.kernel.org/stable/c/997f67d813ce0cf5eb3cdb8f124da68141e91b6c\"}, {\"url\": \"https://git.kernel.org/stable/c/4cdc55ec6222bb195995cc58f7cb46e4d8907056\"}, {\"url\": \"https://git.kernel.org/stable/c/0bfcb7b71e735560077a42847f69597ec7dcc326\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\\n\\nsyzbot managed to call xt_cluster match via ebtables:\\n\\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\\n [..]\\n ebt_do_table+0x174b/0x2a40\\n\\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\\nprocessing.  As this is only useful to restrict locally terminating\\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\\n\\nPablo points out that this is a general issue, direct users of the\\nset/getsockopt interface can call into targets/matches that were only\\nintended for use with ip(6)tables.\\n\\nCheck all UNSPEC matches and targets for similar issues:\\n\\n- matches and targets are fine except if they assume skb_network_header()\\n  is valid -- this is only true when called from inet layer: ip(6) stack\\n  pulls the ip/ipv6 header into linear data area.\\n- targets that return XT_CONTINUE or other xtables verdicts must be\\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\\n\\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\\nthey are provided for use by ip(6)tables.\\n\\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\\n\\nWhile at it, bail out if connbytes fails to enable the corresponding\\nconntrack family.\\n\\nThis change passes the selftests in iptables.git.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:44:25.094Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50038\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:24:43.902Z\", \"dateReserved\": \"2024-10-21T12:17:06.070Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:38.451Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.