CVE-2024-27397

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: use timestamp to check for set element timeout<br /> <br /> Add a timestamp field at the beginning of the transaction, store it<br /> in the nftables per-netns area.<br /> <br /> Update set backend .insert, .deactivate and sync gc path to use the<br /> timestamp, this avoids that an element expires while control plane<br /> transaction is still unfinished.<br /> <br /> .lookup and .update, which are used from packet path, still use the<br /> current time to check if the element has expired. And .get path and dump<br /> also since this runs lockless under rcu read size lock. Then, there is<br /> async gc which also needs to check the current time since it runs<br /> asynchronously from a workqueue.