CVE-2024-57947

A buffer overflow vulnerability exists in the Linux kernel. After each round in the map search step, the result and the fill map are swapped. If a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map, resulting in loss of system availability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires specific nftables configurations involving concatenated range sets and typically demands administrative privileges or user namespace permissions to manage packet filtering rules. When pipapo sets are configured with non-uniform field sizes, improper bitmap initialization can cause incorrect lookup evaluations or destabilize the kernel, compromising system availability. Systems that do not employ multi-field range sets in their firewall definitions are not exposed to this flaw during normal network operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.