{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-35897","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.114Z","datePublished":"2024-05-19T08:34:51.799Z","dateUpdated":"2026-08-05T11:30:48.771Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:30:48.771Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: discard table flag update with pending basechain deletion\n\nHook unregistration is deferred to the commit phase, same occurs with\nhook updates triggered by the table dormant flag. When both commands are\ncombined, this results in deleting a basechain while leaving its hook\nstill registered in the core."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through an nfnetlink/nf_tables netlink batch transaction (NFT_MSG_DELCHAIN + NFT_MSG_NEWTABLE flag update), which requires local access to the system; per kernel guidance netfilter/nftables is Local.\nAC:L - The attacker deterministically constructs the offending single batch (delete basechain, then set the table dormant flag) and then triggers the stale hook at will with self-generated traffic in their own netns; no race or uncontrollable precondition is involved.\nPR:L - nfnetlink_rcv() requires only ns_capable(net->user_ns, CAP_NET_ADMIN), which an unprivileged user obtains via \"unshare -Urn\" on distributions that enable unprivileged user namespaces, so basic user privileges suffice.\nUI:N - The attacker performs the entire sequence — batch submission, heap spray, and packet generation through the stale hook — with no action from any other user.\nS:U - The freed basechain and the netfilter hook infrastructure are both kernel objects in the same security authority; this is standard kernel privilege escalation with no VM/IOMMU boundary crossed.\nC:H - The dangling nf_hook_entry makes nft_do_chain() dereference a freed, attacker-reallocatable nft_base_chain (chain->blob_gen_0 and the rule blob), yielding a use-after-free read primitive over arbitrary kernel memory.\nI:H - After spraying the freed kmalloc-cg basechain, the attacker controls the rule blob and thus expr->ops->eval, giving an indirect call through an attacker-controlled function pointer — full control-flow hijack and kernel memory modification.\nA:H - Even without exploitation, the first packet through the stale hook dereferences freed memory, causing an oops/panic (or a \"hook not found\" WARN in the mirrored ordering), taking down the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"],"versions":[{"version":"bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3","lessThan":"e75faf01e22ec7dc671640fa0e0968964fafd2fc","status":"affected","versionType":"git"},{"version":"e10f661adc556c4969c70ddaddf238bffdaf1e87","lessThan":"9a3b90904d8a072287480eed4c3ece4b99d64f78","status":"affected","versionType":"git"},{"version":"d9c4da8cb74e8ee6e58a064a3573aa37acf6c935","lessThan":"b58d0ac35f6d75ec1db8650a29dfd6f292c11362","status":"affected","versionType":"git"},{"version":"179d9ba5559a756f4322583388b3213fe4e391b0","lessThan":"6cbbe1ba76ee7e674a86abd43009b083a45838cb","status":"affected","versionType":"git"},{"version":"179d9ba5559a756f4322583388b3213fe4e391b0","lessThan":"2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4","status":"affected","versionType":"git"},{"version":"179d9ba5559a756f4322583388b3213fe4e391b0","lessThan":"9627fd0c6ea1c446741a33e67bc5709c59923827","status":"affected","versionType":"git"},{"version":"179d9ba5559a756f4322583388b3213fe4e391b0","lessThan":"7f609f630951b624348373cef99991ce08831927","status":"affected","versionType":"git"},{"version":"179d9ba5559a756f4322583388b3213fe4e391b0","lessThan":"1bc83a019bbe268be3526406245ec28c2458a518","status":"affected","versionType":"git"},{"version":"5.4.262","lessThan":"5.4.274","status":"affected","versionType":"semver"},{"version":"5.10.202","lessThan":"5.10.215","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.4.274","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.215","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.155","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.86","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.26","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.5","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.262","versionEndExcluding":"5.4.274"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.202","versionEndExcluding":"5.10.215"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.155"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.1.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.8.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc"},{"url":"https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78"},{"url":"https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362"},{"url":"https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb"},{"url":"https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4"},{"url":"https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827"},{"url":"https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927"},{"url":"https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518"}],"title":"netfilter: nf_tables: discard table flag update with pending basechain deletion","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:48.782Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35897","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:41:11.412085Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:16.369Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:52:33.119Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]},"dataVersion":"5.2"}