Buffer Initialization Issue in Linux Kernel Netfilter Leading to Set Matching Errors

CVE-2024-57947

Summary

A vulnerability in the Linux kernel's Netfilter component affects the initial buffer initialization for pipapo map fills. The flaw occurs when the initial buffer is not properly set, leading to potential incorrect matching results when the size of the first element in a set is smaller than the maximum allowed size. This misconfiguration can cause improper results to propagate during subsequent rounds of matching, potentially compromising data integrity. A follow-up patch has been introduced to improve the self-test script, ensuring more robust validation of this functionality.

References