CVE-2024-53141

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-53141", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.997Z", "datePublished": "2024-12-06T09:37:02.009Z", "dateUpdated": "2026-10-15T21:41:46.530Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:04.792Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\n\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\n\nSo we should add missing range checks and remove unnecessary range checks."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable function is reached via NFNETLINK_SUBSYS_IPSET netlink messages (IPSET_CMD_ADD/DEL/TEST) over a local netfilter socket, not from remote network packets.\nAC:L - The attacker fully controls all inputs (the set's first_ip/last_ip at create time, and the IP/CIDR at add time) and triggers the out-of-bounds deterministically; there is no race or attacker-uncontrolled condition.\nPR:L - ipset netlink operations require CAP_NET_ADMIN, but nfnetlink checks it against net->user_ns, so an unprivileged local user obtains it via `unshare -Urn`; per guidance netfilter reachable through user namespaces is Low.\nUI:N - The set creation and the malicious add command are performed entirely by the attacker; no victim action is required.\nS:U - The out-of-bounds access corrupts kernel heap within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The truncated out-of-range id drives out-of-bounds accesses (test_bit/test_and_clear_bit and get_ext pointer arithmetic) that can read adjacent heap memory, exposing sensitive kernel data.\nI:H - The bug yields an attacker-influenced heap out-of-bounds write (set_bit at a controlled offset plus OOB extension-data writes), enabling heap corruption and control-flow hijack primitives.\nA:H - The out-of-bounds bitmap/extension access reliably corrupts kernel memory, producing an oops/panic and denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "versions": [{"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "3c20b5948f119ae61ee35ad8584d666020c91581", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "78b0f2028f1043227a8eb0c41944027fc6a04596", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "2e151b8ca31607d14fddc4ad0f14da0893e1a7c7", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "e67471437ae9083fa73fa67eee1573fec1b7c8cf", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "7ffef5e5d5eeecd9687204a5ec2d863752aafb7e", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "856023ef032d824309abd5c747241dffa33aae8c", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "591efa494a1cf649f50a35def649c43ae984cd03", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "15794835378ed56fb9bacc6a5dd3b9f33520604e", "status": "affected", "versionType": "git"}, {"version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "35f56c554eb1b56b77b3cf197a6b00922d49033d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.325", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "4.19.325"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.10.231"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.15.174"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.11.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581"}, {"url": "https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596"}, {"url": "https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7"}, {"url": "https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf"}, {"url": "https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e"}, {"url": "https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c"}, {"url": "https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03"}, {"url": "https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e"}, {"url": "https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d"}], "title": "netfilter: ipset: add missing range check in bitmap_ip_uadt", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:46:21.162Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-53141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:40:52.037310Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:46.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:46:21.162Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-53141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:40:52.037310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:40:52.510Z"}}], "cna": {"title": "netfilter: ipset: add missing range check in bitmap_ip_uadt", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable function is reached via NFNETLINK_SUBSYS_IPSET netlink messages (IPSET_CMD_ADD/DEL/TEST) over a local netfilter socket, not from remote network packets.\nAC:L - The attacker fully controls all inputs (the set's first_ip/last_ip at create time, and the IP/CIDR at add time) and triggers the out-of-bounds deterministically; there is no race or attacker-uncontrolled condition.\nPR:L - ipset netlink operations require CAP_NET_ADMIN, but nfnetlink checks it against net->user_ns, so an unprivileged local user obtains it via `unshare -Urn`; per guidance netfilter reachable through user namespaces is Low.\nUI:N - The set creation and the malicious add command are performed entirely by the attacker; no victim action is required.\nS:U - The out-of-bounds access corrupts kernel heap within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The truncated out-of-range id drives out-of-bounds accesses (test_bit/test_and_clear_bit and get_ext pointer arithmetic) that can read adjacent heap memory, exposing sensitive kernel data.\nI:H - The bug yields an attacker-influenced heap out-of-bounds write (set_bit at a controlled offset plus OOB extension-data writes), enabling heap corruption and control-flow hijack primitives.\nA:H - The out-of-bounds bitmap/extension access reliably corrupts kernel memory, producing an oops/panic and denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "3c20b5948f119ae61ee35ad8584d666020c91581", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "78b0f2028f1043227a8eb0c41944027fc6a04596", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "2e151b8ca31607d14fddc4ad0f14da0893e1a7c7", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "e67471437ae9083fa73fa67eee1573fec1b7c8cf", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "7ffef5e5d5eeecd9687204a5ec2d863752aafb7e", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "856023ef032d824309abd5c747241dffa33aae8c", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "591efa494a1cf649f50a35def649c43ae984cd03", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "15794835378ed56fb9bacc6a5dd3b9f33520604e", "versionType": "git"}, {"status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "lessThan": "35f56c554eb1b56b77b3cf197a6b00922d49033d", "versionType": "git"}], "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.39", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.325", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.287", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.231", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.174", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.120", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.64", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.11", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12.2", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581"}, {"url": "https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596"}, {"url": "https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7"}, {"url": "https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf"}, {"url": "https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e"}, {"url": "https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c"}, {"url": "https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03"}, {"url": "https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e"}, {"url": "https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\n\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\n\nSo we should add missing range checks and remove unnecessary range checks."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.325", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.231", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.174", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.120", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.64", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.11", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.2", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "2.6.39"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:04.792Z"}}}, "cveMetadata": {"cveId": "CVE-2024-53141", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:46.530Z", "dateReserved": "2024-11-19T17:17:24.997Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-06T09:37:02.009Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c20b5948f119ae61ee35ad8584d666020c91581", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "78b0f2028f1043227a8eb0c41944027fc6a04596", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "2e151b8ca31607d14fddc4ad0f14da0893e1a7c7", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "e67471437ae9083fa73fa67eee1573fec1b7c8cf", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "7ffef5e5d5eeecd9687204a5ec2d863752aafb7e", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "856023ef032d824309abd5c747241dffa33aae8c", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "591efa494a1cf649f50a35def649c43ae984cd03", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "15794835378ed56fb9bacc6a5dd3b9f33520604e", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}, {"lessThan": "35f56c554eb1b56b77b3cf197a6b00922d49033d", "status": "affected", "version": "72205fc68bd13109576aa6c4c12c740962d28a6c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/ipset/ip_set_bitmap_ip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"lessThan": "2.6.39", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.325", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.287", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.231", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.174", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.64", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.11", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C7770FA-B486-4531-9A29-FE9BC1D2E0D9", "versionEndExcluding": "4.19.325", "versionStartIncluding": "2.6.39", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D42B3E7C-85DF-4DBF-A6EC-E45F69FF2DCA", "versionEndExcluding": "6.6.64", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893", "versionEndExcluding": "6.11.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\n\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\n\nSo we should add missing range checks and remove unnecessary range checks."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: ipset: agrega comprobaci\u00f3n de rango faltante en bitmap_ip_uadt Cuando tb[IPSET_ATTR_IP_TO] no est\u00e1 presente pero tb[IPSET_ATTR_CIDR] existe, los valores de ip e ip_to se intercambian ligeramente. Por lo tanto, la comprobaci\u00f3n de rango para ip deber\u00eda realizarse m\u00e1s tarde, pero esta parte falta y parece que ocurre la vulnerabilidad. Por lo tanto, deber\u00edamos agregar las comprobaciones de rango faltantes y eliminar las comprobaciones de rango innecesarias."}], "id": "CVE-2024-53141", "lastModified": "2026-10-15T22:18:00.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-53141", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:40:52.037310Z", "version": "2.0.3"}}]}, "published": "2024-12-06T10:15:06.050", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:7899", "cpe": "cpe:/o:redhat:rhel_aus:7.7", "package": "kernel-0:3.10.0-1062.98.1.el7", "product_name": "Red Hat Enterprise Linux 7.7 Advanced Update Support", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7732", "cpe": "cpe:/a:redhat:rhel_extras_rt_els:7", "package": "kernel-rt-0:3.10.0-1160.135.1.rt56.1287.el7", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:7898", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "kernel-0:3.10.0-1160.135.1.el7", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7532", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.52.1.rt7.393.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-05-14T00:00:00Z"}, {"advisory": "RHSA-2025:7531", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.52.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-05-14T00:00:00Z"}, {"advisory": "RHSA-2025:8345", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:7675", "cpe": "cpe:/o:redhat:rhel_aus:8.2", "package": "kernel-0:4.18.0-193.152.1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:7901", "cpe": "cpe:/o:redhat:rhel_aus:8.4", "package": "kernel-0:4.18.0-305.157.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7902", "cpe": "cpe:/a:redhat:rhel_tus:8.4::nfv", "package": "kernel-rt-0:4.18.0-305.157.1.rt7.234.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7901", "cpe": "cpe:/o:redhat:rhel_tus:8.4", "package": "kernel-0:4.18.0-305.157.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7901", "cpe": "cpe:/o:redhat:rhel_e4s:8.4", "package": "kernel-0:4.18.0-305.157.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:8348", "cpe": "cpe:/o:redhat:rhel_e4s:8.4", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:7652", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.145.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:7652", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.145.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:7652", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.145.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:8347", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:7682", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.97.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:8346", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:7897", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "kernel-0:5.14.0-70.132.1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:7896", "cpe": "cpe:/a:redhat:rhel_e4s:9.0::nfv", "package": "kernel-rt-0:5.14.0-70.132.1.rt21.204.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:8344", "cpe": "cpe:/o:redhat:rhel_e4s:9.0", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:7533", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.116.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-05-14T00:00:00Z"}, {"advisory": "RHSA-2025:7534", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.116.1.rt14.401.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-05-14T00:00:00Z"}, {"advisory": "RHSA-2025:8343", "cpe": "cpe:/o:redhat:rhel_eus:9.2", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:7526", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.68.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-05-14T00:00:00Z"}, {"advisory": "RHSA-2025:8342", "cpe": "cpe:/o:redhat:rhel_eus:9.4", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-06-02T00:00:00Z"}], "bugzilla": {"description": "kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt", "id": "2330763", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330763"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\nSo we should add missing range checks and remove unnecessary range checks."], "mitigation": {"lang": "en:us", "value": "In order to trigger the issue, it requires the ability to create user/net namespaces.\nOn non-containerized deployments of Red Hat Enterprise Linux 8, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0:\n# echo \"user.max_user_namespaces=0\" > /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled."}, "name": "CVE-2024-53141", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-53141\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-53141\nhttps://lore.kernel.org/linux-cve-announce/2024120606-CVE-2024-53141-195b@gregkh/T"], "statement": "For the Red Hat Enterprise Linux 9, the vulnerability fixed starting from the 9.6 version.\nThe attack complexity is High, because existing reproducer doesn't work for Red Hat Enterprise Linux 8 (any version) or Fedora (latest version) or Red Hat Enterprise Linux 9 (latest version). It would require some complex tuning before potentially could be used with the Red Hat Enterprise Linux 8. For the Red Hat Enterprise Linux 8 please use mitigation and for Red Hat Enterprise Linux 9 (or Fedora) update to latest version.\nOnly local users with `CAP_NET_ADMIN` capability or root can trigger this issue. \nOn Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.\nThe OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, therefore, it is also affected by this kernel vulnerability. A successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access. A local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching the namespace in the running OpenShift container will not bring necessary capabilities.\nThis means that for OpenShift, the impact of this vulnerability is Low.\nSimilar to the CVE-2023-32233 vulnerability, this has been explained in the following blog post as an example of a \"Container escape vulnerability\":\nhttps://www.redhat.com/en/blog/containers-vulnerability-risk-assessment", "threat_severity": "Important"}

{}