{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-27415","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-25T13:47:42.682Z","datePublished":"2024-05-17T11:51:00.711Z","dateUpdated":"2026-08-05T11:29:44.276Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:29:44.276Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: confirm multicast packets before passing them up the stack\n\nconntrack nf_confirm logic cannot handle cloned skbs referencing\nthe same nf_conn entry, which will happen for multicast (broadcast)\nframes on bridges.\n\n Example:\n    macvlan0\n       |\n      br0\n     /  \\\n  ethX    ethY\n\n ethX (or Y) receives a L2 multicast or broadcast packet containing\n an IP packet, flow is not yet in conntrack table.\n\n 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting.\n    -> skb->_nfct now references a unconfirmed entry\n 2. skb is broad/mcast packet. bridge now passes clones out on each bridge\n    interface.\n 3. skb gets passed up the stack.\n 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb\n    and schedules a work queue to send them out on the lower devices.\n\n    The clone skb->_nfct is not a copy, it is the same entry as the\n    original skb.  The macvlan rx handler then returns RX_HANDLER_PASS.\n 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb.\n\nThe Macvlan broadcast worker and normal confirm path will race.\n\nThis race will not happen if step 2 already confirmed a clone. In that\ncase later steps perform skb_clone() with skb->_nfct already confirmed (in\nhash table).  This works fine.\n\nBut such confirmation won't happen when eb/ip/nftables rules dropped the\npackets before they reached the nf_confirm step in postrouting.\n\nPablo points out that nf_conntrack_bridge doesn't allow use of stateful\nnat, so we can safely discard the nf_conn entry and let inet call\nconntrack again.\n\nThis doesn't work for bridge netfilter: skb could have a nat\ntransformation. Also bridge nf prevents re-invocation of inet prerouting\nvia 'sabotage_in' hook.\n\nWork around this problem by explicit confirmation of the entry at LOCAL_IN\ntime, before upper layer has a chance to clone the unconfirmed entry.\n\nThe downside is that this disables NAT and conntrack helpers.\n\nAlternative fix would be to add locking to all code parts that deal with\nunconfirmed packets, but even if that could be done in a sane way this\nopens up other problems, for example:\n\n-m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4\n-m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5\n\nFor multicast case, only one of such conflicting mappings will be\ncreated, conntrack only handles 1:1 NAT mappings.\n\nUsers should set create a setup that explicitly marks such traffic\nNOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass\nthem, ruleset might have accept rules for untracked traffic already,\nso user-visible behaviour would change."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The trigger is a received link-layer broadcast/multicast IP frame arriving on a bridge port (the hook only runs when `skb->pkt_type != PACKET_HOST`), so the attacker must be in the same L2 broadcast domain — a LAN neighbor, a co-tenant VM/container on the same bridge, or a guest behind a tap port. Broadcast frames cannot be routed, which bounds this to adjacent rather than full network reach.\nAC:L - One attacker-sent broadcast/multicast packet is itself what forks into the two racing skbs (original up the stack vs. `macvlan_broadcast_enqueue` clone deferred to `bc_work` on another CPU), so the attacker controls both sides of the race and can flood packets to hit it repeatedly and reliably. macvlan/tap-over-bridge with br_netfilter and conntrack is a mainstream Docker/libvirt/unraid configuration, not a rare one.\nPR:N - The entire path is inbound packet processing in softirq and a kernel workqueue — no syscall, no socket, no credentials, and no capability check is crossed. An unauthenticated host on the segment simply emits broadcast/multicast traffic.\nUI:N - The bridge, macvlan and conntrack hooks process the attacker's frames automatically on receipt; no administrator or user action is needed at any point.\nS:U - The vulnerable code and the corrupted objects (`nf_conn`, `ct->ext`, the conntrack and nf_nat_bysource hash tables) all live in the host kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - Concurrent unlocked `krealloc()` of `ct->ext` and duplicate `hlist_add_head_rcu()` of `ct->nat_bysource` yield a double-free/use-after-free on slab objects whose contents the attacker can influence by shaping subsequent traffic, giving a path to reading reclaimed kernel memory. Per kernel scoring guidance, UAF-class corruption is High.\nI:H - The same double-free and duplicate list-node insertions provide a write primitive into freed/reallocated slab memory and into RCU hash chains, and the non-atomic `ct->status` read-modify-write plus conflicting NAT mappings additionally corrupt firewall/NAT state. Memory corruption of this class is scored High for integrity.\nA:H - The in-the-wild manifestation is a `WARN_ON_ONCE()` splat in `__nf_conntrack_confirm()` — an oops-class event that panics outright under `panic_on_warn` — and the underlying list corruption and refcount imbalance lead to hlist corruption and premature `nf_conn` free, i.e. kernel crashes, all repeatedly inducible by continued broadcast traffic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netfilter.h","net/bridge/br_netfilter_hooks.c","net/bridge/netfilter/nf_conntrack_bridge.c","net/netfilter/nf_conntrack_core.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7c3f28599652acf431a2211168de4a583f30b6d5","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2b1414d5e94e477edff1d2c79030f1d742625ea0","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"80cd0487f630b5382734997c3e5e3003a77db315","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cb734975b0ffa688ff6cc0eed463865bf07b6c01","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"62e7151ae3eb465e0ab52a20c941ff33bb6332e9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netfilter.h","net/bridge/br_netfilter_hooks.c","net/bridge/netfilter/nf_conntrack_bridge.c","net/netfilter/nf_conntrack_core.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.15.151","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.81","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.21","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.9","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/7c3f28599652acf431a2211168de4a583f30b6d5"},{"url":"https://git.kernel.org/stable/c/2b1414d5e94e477edff1d2c79030f1d742625ea0"},{"url":"https://git.kernel.org/stable/c/80cd0487f630b5382734997c3e5e3003a77db315"},{"url":"https://git.kernel.org/stable/c/cb734975b0ffa688ff6cc0eed463865bf07b6c01"},{"url":"https://git.kernel.org/stable/c/62e7151ae3eb465e0ab52a20c941ff33bb6332e9"}],"title":"netfilter: bridge: confirm multicast packets before passing them up the stack","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:34:52.234Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/7c3f28599652acf431a2211168de4a583f30b6d5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2b1414d5e94e477edff1d2c79030f1d742625ea0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/80cd0487f630b5382734997c3e5e3003a77db315","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cb734975b0ffa688ff6cc0eed463865bf07b6c01","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/62e7151ae3eb465e0ab52a20c941ff33bb6332e9","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-27415","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:43:06.843956Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:24.879Z"}}]}}