VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-35962

CVE-2024-35962

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Incomplete user input validation in Linux kernel netfilter's do_replace() handlers could allow local attackers to cause a denial of service or memory corruption.

Vulnerability

The Linux kernel's netfilter subsystem contained a missing validation check in the do_replace() handlers. After a previous fix addressed copy_from_sockptr() calls, the subsequent copy_from_sockptr_offset() calls remained unsafe. The code failed to verify that the user-supplied optlen was at least as large as the expected structure size (tmp.size + sizeof(tmp)), allowing a smaller value to be passed to xt_alloc_table_info().

Exploitation

A local user with CAP_NET_ADMIN capability can exploit this by crafting a setsockopt() call with a deliberately small optlen. The vulnerability requires local access and the ability to invoke netfilter operations, but no additional authentication. The attack complexity is low.

Impact

Successful exploitation could lead to out-of-bounds memory access, potentially causing a system crash (denial of service) or, in some cases, privilege escalation. The CVSS v3 base score is 5.5 (Medium), with high availability impact.

Mitigation

The fix adds a size check before calling xt_alloc_table_info(), returning -EINVAL if the condition fails. The patch was applied to the stable kernel branches as seen in commits [3] and [4]. Users should update to the latest kernel version to remediate the issue.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

179

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.