CVE-2024-27017

What it actually does

Race condition in nft_set_pipapo netlink dump iterator allows the generation mask to change mid-walk, causing the iterator to use an inconsistent view of the pipapo set data structure and potentially perform unauthorized updates.

Why it matters to the business

Local users on affected Linux systems can corrupt kernel networking set state, leading to denial of service, unexpected packet processing behavior, or integrity violations in firewall rules; widespread kernel exposure increases patch urgency across servers and appliances.

How an attack unfolds

A local attacker triggers concurrent netlink dump operations on an nftables set while the kernel updates the generation mask, causing the pipapo walk iterator to read or write the wrong data view and alter set contents without authorization.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.227 or apply the commits ff89db14c63a827066446460e39226c0688ef786 (and equivalents in other stable branches); rebuild and reboot systems using the patched kernel; rebuild any out-of-tree modules that depend on the netfilter set API.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; confirm the nft_set_pipapo.c source contains the updated walk iterator logic with explicit read/update notation; test netlink dump operations under concurrent modification to ensure no inconsistent views are observed.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Create or interact with an nftables pipapo set
3. Issue concurrent netlink dump requests while set modifications occur
4. Trigger the race to force use of stale generation mask view
5. Observe or induce integrity violation in the set data structure

How to detect it

Review system logs for unusual netlink activity involving nftables sets during set modification operations; look for kernel oops or warnings referencing nft_set_pipapo walk iterators; correlate process execution of nft or ip commands with set update syscalls.

What your security team should do

• Immediately inventory all Linux systems and prioritize patching those exposing nftables to untrusted local users
• Apply kernel updates to 5.10.227 or later within the next maintenance window
• Restrict unprivileged local access to systems using nftables pipapo sets until patched
• Monitor for new EPSS increases or public exploit code and accelerate patching if observed