CVE-2024-27018

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: br_netfilter: skip conntrack input hook for promisc packets

For historical reasons, when bridge device is in promisc mode, packets

that are directed to the taps follow bridge input hook path. This patch

adds a workaround to reset conntrack for these packets.

Jianbo Liu reports warning splats in their test infrastructure where

cloned packets reach the br_netfilter input hook to confirm the

conntrack object.

Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has

reached the input hook because it is passed up to the bridge device to

reach the taps.

[ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter]

[ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References