CVE-2024-53141 (GCVE-0-2024-53141)
Vulnerability from cvelistv5
Published
2024-12-06 09:37
Modified
2026-08-05 11:44
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.
Impacted products
Vendor Product Version
Linux Linux Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Version: 72205fc68bd13109576aa6c4c12c740962d28a6c
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:46:21.162Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_bitmap_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c20b5948f119ae61ee35ad8584d666020c91581",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "78b0f2028f1043227a8eb0c41944027fc6a04596",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "2e151b8ca31607d14fddc4ad0f14da0893e1a7c7",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "e67471437ae9083fa73fa67eee1573fec1b7c8cf",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "7ffef5e5d5eeecd9687204a5ec2d863752aafb7e",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "856023ef032d824309abd5c747241dffa33aae8c",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "591efa494a1cf649f50a35def649c43ae984cd03",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "15794835378ed56fb9bacc6a5dd3b9f33520604e",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            },
            {
              "lessThan": "35f56c554eb1b56b77b3cf197a6b00922d49033d",
              "status": "affected",
              "version": "72205fc68bd13109576aa6c4c12c740962d28a6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_bitmap_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.325",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.325",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\n\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\n\nSo we should add missing range checks and remove unnecessary range checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable function is reached via NFNETLINK_SUBSYS_IPSET netlink messages (IPSET_CMD_ADD/DEL/TEST) over a local netfilter socket, not from remote network packets.\nAC:L - The attacker fully controls all inputs (the set\u0027s first_ip/last_ip at create time, and the IP/CIDR at add time) and triggers the out-of-bounds deterministically; there is no race or attacker-uncontrolled condition.\nPR:L - ipset netlink operations require CAP_NET_ADMIN, but nfnetlink checks it against net-\u003euser_ns, so an unprivileged local user obtains it via `unshare -Urn`; per guidance netfilter reachable through user namespaces is Low.\nUI:N - The set creation and the malicious add command are performed entirely by the attacker; no victim action is required.\nS:U - The out-of-bounds access corrupts kernel heap within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The truncated out-of-range id drives out-of-bounds accesses (test_bit/test_and_clear_bit and get_ext pointer arithmetic) that can read adjacent heap memory, exposing sensitive kernel data.\nI:H - The bug yields an attacker-influenced heap out-of-bounds write (set_bit at a controlled offset plus OOB extension-data writes), enabling heap corruption and control-flow hijack primitives.\nA:H - The out-of-bounds bitmap/extension access reliably corrupts kernel memory, producing an oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:04.792Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581"
        },
        {
          "url": "https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03"
        },
        {
          "url": "https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d"
        }
      ],
      "title": "netfilter: ipset: add missing range check in bitmap_ip_uadt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53141",
    "datePublished": "2024-12-06T09:37:02.009Z",
    "dateReserved": "2024-11-19T17:17:24.997Z",
    "dateUpdated": "2026-08-05T11:44:04.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…