CVE-2024-35897

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-35897", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.114Z", "datePublished": "2024-05-19T08:34:51.799Z", "dateUpdated": "2026-10-15T00:41:15.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:48.771Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: discard table flag update with pending basechain deletion\n\nHook unregistration is deferred to the commit phase, same occurs with\nhook updates triggered by the table dormant flag. When both commands are\ncombined, this results in deleting a basechain while leaving its hook\nstill registered in the core."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through an nfnetlink/nf_tables netlink batch transaction (NFT_MSG_DELCHAIN + NFT_MSG_NEWTABLE flag update), which requires local access to the system; per kernel guidance netfilter/nftables is Local.\nAC:L - The attacker deterministically constructs the offending single batch (delete basechain, then set the table dormant flag) and then triggers the stale hook at will with self-generated traffic in their own netns; no race or uncontrollable precondition is involved.\nPR:L - nfnetlink_rcv() requires only ns_capable(net->user_ns, CAP_NET_ADMIN), which an unprivileged user obtains via \"unshare -Urn\" on distributions that enable unprivileged user namespaces, so basic user privileges suffice.\nUI:N - The attacker performs the entire sequence \u2014 batch submission, heap spray, and packet generation through the stale hook \u2014 with no action from any other user.\nS:U - The freed basechain and the netfilter hook infrastructure are both kernel objects in the same security authority; this is standard kernel privilege escalation with no VM/IOMMU boundary crossed.\nC:H - The dangling nf_hook_entry makes nft_do_chain() dereference a freed, attacker-reallocatable nft_base_chain (chain->blob_gen_0 and the rule blob), yielding a use-after-free read primitive over arbitrary kernel memory.\nI:H - After spraying the freed kmalloc-cg basechain, the attacker controls the rule blob and thus expr->ops->eval, giving an indirect call through an attacker-controlled function pointer \u2014 full control-flow hijack and kernel memory modification.\nA:H - Even without exploitation, the first packet through the stale hook dereferences freed memory, causing an oops/panic (or a \"hook not found\" WARN in the mirrored ordering), taking down the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3", "lessThan": "e75faf01e22ec7dc671640fa0e0968964fafd2fc", "status": "affected", "versionType": "git"}, {"version": "e10f661adc556c4969c70ddaddf238bffdaf1e87", "lessThan": "9a3b90904d8a072287480eed4c3ece4b99d64f78", "status": "affected", "versionType": "git"}, {"version": "d9c4da8cb74e8ee6e58a064a3573aa37acf6c935", "lessThan": "b58d0ac35f6d75ec1db8650a29dfd6f292c11362", "status": "affected", "versionType": "git"}, {"version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "6cbbe1ba76ee7e674a86abd43009b083a45838cb", "status": "affected", "versionType": "git"}, {"version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4", "status": "affected", "versionType": "git"}, {"version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "9627fd0c6ea1c446741a33e67bc5709c59923827", "status": "affected", "versionType": "git"}, {"version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "7f609f630951b624348373cef99991ce08831927", "status": "affected", "versionType": "git"}, {"version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "1bc83a019bbe268be3526406245ec28c2458a518", "status": "affected", "versionType": "git"}, {"version": "5.4.262", "lessThan": "5.4.274", "status": "affected", "versionType": "semver"}, {"version": "5.10.202", "lessThan": "5.10.215", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.155", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.86", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.262", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.202", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.155"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc"}, {"url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78"}, {"url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362"}, {"url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb"}, {"url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4"}, {"url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827"}, {"url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927"}, {"url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518"}], "title": "netfilter: nf_tables: discard table flag update with pending basechain deletion", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.782Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:41:11.412085Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:16.369Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:41:15.106Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.782Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:41:15.106Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:41:11.412085Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:15.850Z"}}], "cna": {"title": "netfilter: nf_tables: discard table flag update with pending basechain deletion", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through an nfnetlink/nf_tables netlink batch transaction (NFT_MSG_DELCHAIN + NFT_MSG_NEWTABLE flag update), which requires local access to the system; per kernel guidance netfilter/nftables is Local.\nAC:L - The attacker deterministically constructs the offending single batch (delete basechain, then set the table dormant flag) and then triggers the stale hook at will with self-generated traffic in their own netns; no race or uncontrollable precondition is involved.\nPR:L - nfnetlink_rcv() requires only ns_capable(net->user_ns, CAP_NET_ADMIN), which an unprivileged user obtains via \"unshare -Urn\" on distributions that enable unprivileged user namespaces, so basic user privileges suffice.\nUI:N - The attacker performs the entire sequence \u2014 batch submission, heap spray, and packet generation through the stale hook \u2014 with no action from any other user.\nS:U - The freed basechain and the netfilter hook infrastructure are both kernel objects in the same security authority; this is standard kernel privilege escalation with no VM/IOMMU boundary crossed.\nC:H - The dangling nf_hook_entry makes nft_do_chain() dereference a freed, attacker-reallocatable nft_base_chain (chain->blob_gen_0 and the rule blob), yielding a use-after-free read primitive over arbitrary kernel memory.\nI:H - After spraying the freed kmalloc-cg basechain, the attacker controls the rule blob and thus expr->ops->eval, giving an indirect call through an attacker-controlled function pointer \u2014 full control-flow hijack and kernel memory modification.\nA:H - Even without exploitation, the first packet through the stale hook dereferences freed memory, causing an oops/panic (or a \"hook not found\" WARN in the mirrored ordering), taking down the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3", "lessThan": "e75faf01e22ec7dc671640fa0e0968964fafd2fc", "versionType": "git"}, {"status": "affected", "version": "e10f661adc556c4969c70ddaddf238bffdaf1e87", "lessThan": "9a3b90904d8a072287480eed4c3ece4b99d64f78", "versionType": "git"}, {"status": "affected", "version": "d9c4da8cb74e8ee6e58a064a3573aa37acf6c935", "lessThan": "b58d0ac35f6d75ec1db8650a29dfd6f292c11362", "versionType": "git"}, {"status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "6cbbe1ba76ee7e674a86abd43009b083a45838cb", "versionType": "git"}, {"status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4", "versionType": "git"}, {"status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "9627fd0c6ea1c446741a33e67bc5709c59923827", "versionType": "git"}, {"status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "7f609f630951b624348373cef99991ce08831927", "versionType": "git"}, {"status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "lessThan": "1bc83a019bbe268be3526406245ec28c2458a518", "versionType": "git"}, {"status": "affected", "version": "5.4.262", "lessThan": "5.4.274", "versionType": "semver"}, {"status": "affected", "version": "5.10.202", "lessThan": "5.10.215", "versionType": "semver"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.155", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.86", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.26", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc"}, {"url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78"}, {"url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362"}, {"url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb"}, {"url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4"}, {"url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827"}, {"url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927"}, {"url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: discard table flag update with pending basechain deletion\n\nHook unregistration is deferred to the commit phase, same occurs with\nhook updates triggered by the table dormant flag. When both commands are\ncombined, this results in deleting a basechain while leaving its hook\nstill registered in the core."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.262"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.202"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.155", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.86", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.26", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:48.771Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35897", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:41:15.106Z", "dateReserved": "2024-05-17T13:50:33.114Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:34:51.799Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e75faf01e22ec7dc671640fa0e0968964fafd2fc", "status": "affected", "version": "bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3", "versionType": "git"}, {"lessThan": "9a3b90904d8a072287480eed4c3ece4b99d64f78", "status": "affected", "version": "e10f661adc556c4969c70ddaddf238bffdaf1e87", "versionType": "git"}, {"lessThan": "b58d0ac35f6d75ec1db8650a29dfd6f292c11362", "status": "affected", "version": "d9c4da8cb74e8ee6e58a064a3573aa37acf6c935", "versionType": "git"}, {"lessThan": "6cbbe1ba76ee7e674a86abd43009b083a45838cb", "status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "versionType": "git"}, {"lessThan": "2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4", "status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "versionType": "git"}, {"lessThan": "9627fd0c6ea1c446741a33e67bc5709c59923827", "status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "versionType": "git"}, {"lessThan": "7f609f630951b624348373cef99991ce08831927", "status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "versionType": "git"}, {"lessThan": "1bc83a019bbe268be3526406245ec28c2458a518", "status": "affected", "version": "179d9ba5559a756f4322583388b3213fe4e391b0", "versionType": "git"}, {"lessThan": "5.4.274", "status": "affected", "version": "5.4.262", "versionType": "semver"}, {"lessThan": "5.10.215", "status": "affected", "version": "5.10.202", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.155", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.86", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6935F9BF-B6AA-4B2F-8E03-E5276F7BD328", "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.262", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C22D117-3E7D-436E-8613-012B70C8A0AA", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.202", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2BEFCD1-DCBE-48B6-BF56-06AEFA03CC0C", "versionEndExcluding": "5.15.155", "versionStartIncluding": "5.13.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5D13FF4-8931-475F-A397-FD0594589F56", "versionEndExcluding": "6.1.86", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C520696A-A594-4FFC-A32D-12DA535CE911", "versionEndExcluding": "6.6.26", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*", "matchCriteriaId": "8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*", "matchCriteriaId": "25A855BA-2118-44F2-90EF-EBBB12AF51EF", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc7:*:*:*:*:*:*", "matchCriteriaId": "F63101C7-E7A3-4C74-9CD5-B5FC5F53F5C8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: discard table flag update with pending basechain deletion\n\nHook unregistration is deferred to the commit phase, same occurs with\nhook updates triggered by the table dormant flag. When both commands are\ncombined, this results in deleting a basechain while leaving its hook\nstill registered in the core."}, {"lang": "es", "value": " En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: nf_tables: descartar actualizaci\u00f3n del indicador de tabla con eliminaci\u00f3n pendiente de la cadena base. La cancelaci\u00f3n del registro del gancho se difiere hasta la fase de confirmaci\u00f3n; lo mismo ocurre con las actualizaciones del gancho activadas por el indicador inactivo de la tabla. Cuando se combinan ambos comandos, esto da como resultado la eliminaci\u00f3n de una cadena base y deja su gancho a\u00fan registrado en el n\u00facleo."}], "id": "CVE-2024-35897", "lastModified": "2026-10-15T01:17:51.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35897", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:41:11.412085Z", "version": "2.0.3"}}]}, "published": "2024-05-19T09:15:10.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5928", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.33.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-28T00:00:00Z"}, {"advisory": "RHSA-2024:5928", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.33.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-28T00:00:00Z"}, {"advisory": "RHSA-2024:5257", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "kernel-0:5.14.0-70.112.1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-08-13T00:00:00Z"}, {"advisory": "RHSA-2024:5256", "cpe": "cpe:/a:redhat:rhel_e4s:9.0::nfv", "package": "kernel-rt-0:5.14.0-70.112.1.rt21.184.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-08-13T00:00:00Z"}, {"advisory": "RHSA-2024:4823", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.75.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}, {"advisory": "RHSA-2024:4831", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.75.1.rt14.360.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}], "bugzilla": {"description": "kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion", "id": "2281672", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281672"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_tables: discard table flag update with pending basechain deletion\nHook unregistration is deferred to the commit phase, same occurs with\nhook updates triggered by the table dormant flag. When both commands are\ncombined, this results in deleting a basechain while leaving its hook\nstill registered in the core."], "name": "CVE-2024-35897", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35897\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35897\nhttps://lore.kernel.org/linux-cve-announce/2024051951-CVE-2024-35897-1585@gregkh/T"], "threat_severity": "Moderate"}

{}