CVE-2024-26643
Description
RHSA-2024:3627: kernel-rt security and bug fix update (Moderate)
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout Red Hat statement Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Errata / fixed releases…
Workaround
exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Description
kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Red Hat statement
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-553.5.1.rt7.346.el8_10 | RHSA-2024:3627 | 2024-06-05T00:00:00Z |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-553.5.1.el8_10 | RHSA-2024:3618 | 2024-06-05T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-427.18.1.el9_4 | RHSA-2024:3306 | 2024-05-23T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-427.18.1.el9_4 | RHSA-2024:3306 | 2024-05-23T00:00:00Z |
| Red Hat Enterprise Linux 9.2 Extended Update Support | kernel-0:5.14.0-284.67.1.el9_2 | RHSA-2024:3461 | 2024-05-29T00:00:00Z |
| Red Hat Enterprise Linux 9.2 Extended Update Support | kernel-rt-0:5.14.0-284.67.1.rt14.352.el9_2 | RHSA-2024:3460 | 2024-05-29T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected |
| Red Hat Enterprise Linux 7 | kernel | Out of support scope |
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Apply commands
yum update -y kernel-rt
# or:
dnf upgrade -y kernel-rtAffected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 6 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| debian | bookworm | fixed | 6.1.85-1 |
| debian | bullseye | fixed | 5.10.216-1 |
| debian | forky | fixed | 6.7.12-1 |
| debian | sid | fixed | 6.7.12-1 |
| debian | trixie | fixed | 6.7.12-1 |
| linux-kernel | affected | 5.4.274 | |
| debian | 10.0 | affected | |
| almalinux | 8 | fixed | kernel-abi-stablelists-4.18.0-553.5.1.el8_10.noarch.rpm |
| almalinux | 9 | fixed | rv-5.14.0-427.18.1.el9_4.aarch64.rpm |
| rhel | 8 | fixed | |
References
- https://access.redhat.com/errata/RHSA-2024:3306
- https://git.kernel.org/stable/c/291cca35818bd52a407bc37ab45a15816039e363
- https://git.kernel.org/stable/c/406b0241d0eb598a0b330ab20ae325537d8d8163
- https://git.kernel.org/stable/c/5224afbc30c3ca9ba23e752f0f138729b2c48dd8
- https://git.kernel.org/stable/c/552705a3650bbf46a22b1adedc1b04181490fc36
- https://git.kernel.org/stable/c/b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1
- https://git.kernel.org/stable/c/d75a589bb92af1abf3b779cfcd1977ca11b27033
- https://git.kernel.org/stable/c/e2d45f467096e931044f0ab7634499879d851a5c
- https://git.kernel.org/stable/c/edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://errata.rockylinux.org/RLSA-2024:3627
- https://errata.rockylinux.org/RLSA-2024:3618
- https://www.suse.com/security/cve/CVE-2024-26643.html
- https://security-tracker.debian.org/tracker/CVE-2024-26643
- https://access.redhat.com/errata/RHSA-2024:3618
- https://bugzilla.redhat.com/2250843
- https://bugzilla.redhat.com/2257406
- https://bugzilla.redhat.com/2263875
- https://bugzilla.redhat.com/2265271
- https://bugzilla.redhat.com/2265646
- https://bugzilla.redhat.com/2265654
- https://bugzilla.redhat.com/2265833
- https://bugzilla.redhat.com/2266296
- https://bugzilla.redhat.com/2266446
CWEs
CWE-667
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.