CVE-2024-26851

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26851
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c Patch
https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 Patch
https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a Patch
https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 Patch
https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 Patch
https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb Patch
https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 Patch
https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc Patch
https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c Patch
https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 Patch
https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a Patch
https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 Patch
https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 Patch
https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb Patch
https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 Patch
https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

02 Apr 2025, 13:17

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c - () https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c - Patch
References () https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 - () https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 - Patch
References () https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a - () https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a - Patch
References () https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 - () https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 - Patch
References () https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 - () https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 - Patch
References () https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb - () https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb - Patch
References () https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 - () https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 - Patch
References () https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc - () https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Mailing List
First Time Debian
Linux linux Kernel
Debian debian Linux
Linux
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:03

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c - () https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c -
References () https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 - () https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 -
References () https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a - () https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a -
References () https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 - () https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 -
References () https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 - () https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 -
References () https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb - () https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb -
References () https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 - () https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 -
References () https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc - () https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc -

05 Nov 2024, 10:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 13:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_conntrack_h323: Agregar protección para longitud de bmp fuera de rango La carga de UBSAN informa una excepción de BRK#5515 SHIFT_ISSUE: desplazamientos bit a bit que están fuera de los límites para su tipo de datos. vmlinux get_bitmap(b=75) + 712 vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, nivel=134443100) + 1956 vmlinux decode_choice (base=0xFFFFFFD0080370F0, nivel=23843636) + 1216 vmlinux decode_seq(f=0xFFFFFFD0080371A8, nivel=134443500) + 812 vmlinux decode_choice(base =0xFFFFFFD008037280, nivel=0) + 1216 vmlinux DecodeRasMessage() + 304 vmlinux ras_help() + 684 vmlinux nf_confirm() + 188 Debido a datos anormales en skb-&gt;data, la longitud del mapa de bits de la extensión excede 32 cuando se decodifica el mensaje ras y luego usa la longitud para realizar una operación de cambio . Cambiará a negativo después de varios bucles. La carga de UBSAN podría detectar un cambio negativo como un comportamiento indefinido e informar una excepción. Por lo tanto, agregamos la protección para evitar que la longitud exceda 32. De lo contrario, devolverá un error fuera de rango y dejará de decodificar.

17 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 11:15

Updated : 2025-04-02 13:17

NVD link : CVE-2024-26851

Mitre link : CVE-2024-26851

CVE.ORG link : CVE-2024-26851

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write