CVE-2024-35962

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 0f038242b77ddfc505bf4163d4904c1abd2e74d6, < cf4bc359b76144a3dd55d7c09464ef4c5f2b2b05; >= 440e948cf0eff32cfe322dcbca3f2525354b159b, < 97dab36e57c64106e1c8ebd66cbf0d2d1e52d6b7; >= 18aae2cb87e5faa9c5bd865260ceadac60d5a6c5, < c760089aa98289b4b88a7ff5a62dd92845adf223; >= 81d51b9b7c95e791ba3c1a2dd77920a9d3b3f525, < 89242d9584c342cb83311b598d9e6b82572eadf8; >= 58f2bfb789e6bd3bc24a2c9c1580f3c67aec3018, < 562b7245131f6e9f1d280c8b5a8750f03edfc05c; >= 0c83842df40f86e529db6842231154772c20edcc, < 65acf6e0501ac8880a4f73980d01b5d27648b956
LinuxLinux>= 5.10.215, < 5.10.216; >= 5.15.154, < 5.15.156; >= 6.1.85, < 6.1.87; >= 6.6.26, < 6.6.28; >= 6.8.5, < 6.8.7
SiemensRUGGEDCOM RST2428P< V3.1
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family—
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 family< V3.1
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
May 20, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-359637.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check usCVE-2024-359647.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not validating setsockopt user input Check user inCVE-2024-359657.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user CVE-2024-359667.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot repCVE-2024-359677.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reportCVE-2024-359685.5In the Linux kernel, the following vulnerability has been resolved: pds_core: Fix pdsc_check_pci_health function to use work thread When tCVE-2024-359698.8In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr AltCVE-2024-35976.1The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This CVE-2024-359706.3In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. syzkaller started to report deadlock CVE-2024-359715.5In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang The CVE-2024-359725.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() If ulCVE-2024-359735.5In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to
CVE-2024-35962: Medium severity, CVSS 5.5 | Vulnix