CVE-2024-26851

What it actually does

Missing bounds check on extension bitmap length in nf_conntrack_h323_asn1.c allows values >32 during RAS message decoding, producing out-of-bounds left shifts that become negative and trigger undefined behavior.

Why it matters to the business

Systems processing H.323 traffic can experience kernel panics or instability from malformed packets, interrupting network services and requiring reboots; widespread Linux kernel usage amplifies exposure across servers and appliances.

How an attack unfolds

An attacker sends crafted H.323 RAS packets containing oversized bitmap lengths; the conntrack decoder in ras_help() calls decode_seq/decode_choice which invoke get_bitmap with the invalid length, performing repeated out-of-bounds shifts until UBSAN or a crash occurs.

How to fix it

Upgrade the Linux kernel to a version containing commit 98db42191329c679f4ca52bec0b319689e1ad8cb. If H.323 conntrack is unused, unload nf_conntrack_h323 or disable the module via modprobe blacklist.

How to confirm the fix worked

Confirm presence of commit 98db42191329c679f4ca52bec0b319689e1ad8cb in the running kernel; replay malformed H.323 RAS packets in a test environment and verify absence of shift-related UBSAN reports or crashes.

Typical attack path

1. Craft H.323 RAS message with bitmap length exceeding 32
2. Send packet to target triggering nf_conntrack_h323
3. Reach DecodeRasMessage and get_bitmap
4. Execute invalid shift causing negative value
5. Trigger kernel panic or UBSAN exception

How to detect it

Search kernel logs and crash dumps for strings referencing nf_conntrack_h323_asn1.c, DecodeRasMessage, get_bitmap, BRK#5515, or SHIFT_ISSUE; correlate with inbound H.323 traffic spikes.

• nf_conntrack_h323_asn1.c
• DecodeRasMessage
• get_bitmap
• BRK#5515 SHIFT_ISSUE
• ras_help

What your security team should do

• Apply the referenced kernel commit or distribution update as soon as possible
• Disable nf_conntrack_h323 where H.323 support is not required
• Add kernel log monitoring for nf_conntrack_h323 decode errors