CVE-2024-42070
MEDIUMLinux Kernel < 3.13 - Memory Leak
Title source: ruleDescription
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers.
References (9)
Scores
CVSS v3
5.5
EPSS
0.0001
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Classification
CWE
CWE-401
Status
published
Affected Products (1)
linux/linux_kernel
< 3.13
Timeline
Published
Jul 29, 2024
Tracked Since
Feb 18, 2026