APPLIED: [SRU][F][PATCH 0/2] CVE-2024-26668

[Stefan Bader]

On 20.09.24 12:20, Massimiliano Pellizzer wrote:
> [Impact]
> 
> Reject bogus configs where internal token counter wraps around.
> This only occurs with very very large requests, such as 17gbyte/s.
> 
> [Fix]
> 
> Noble:  Not affected
> Jammy:  Fixed
> Focal:  Cherry picked a prereq from linux-5.15.y, and backported the
> fix commit from linux-5.15.y
> Bionic: Sent to ESM ML
> Xenial: Sent to ESM ML
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> The fix for CVE-2024-26668 affects the netfilter subsystem.
> An issue with this fix may lead to kernel crashes, particularly during
> the application or modification of network filtering rules.
> Users may also notice unexpected network behavior.
> 
> Florian Westphal (1):
>    netfilter: nft_limit: reject configurations that cause integer
>      overflow
> 
> Pablo Neira Ayuso (1):
>    netfilter: nft_limit: rename stateful structure
> 
>   net/netfilter/nft_limit.c | 115 ++++++++++++++++++++------------------
>   1 file changed, 62 insertions(+), 53 deletions(-)
> 

Applied to focal:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/94177b73/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/94177b73/attachment-0001.sig>