CVE-2024-50038

What it actually does

The vulnerability allows netfilter matches and targets registered for NFPROTO_UNSPEC to be invoked from ebtables or direct setsockopt/getsockopt calls, where assumptions about valid skb_network_header or XT_CONTINUE verdicts do not hold, resulting in warnings or incorrect processing.

Why it matters to the business

Linux systems may experience kernel warnings or instability during packet filtering operations, raising maintenance costs and potential availability issues in environments with heavy network security configurations.

How an attack unfolds

An attacker with local or network access triggers the mismatch by registering or invoking affected matches like xt_cluster via ebtables rules or raw socket options, exploiting the registration for NFPROTO_UNSPEC instead of specific IPv4/IPv6/ARP families.

How to fix it

Update affected Linux kernels to the fixed commit 85ff9a0f793ca52c527e75cd40a69c948627ebde, which restricts registrations to NFPROTO_IPV4, NFPROTO_IPV6, and NFPROTO_ARP as appropriate and adds checks for conntrack family enablement.

How to confirm the fix worked

Confirm the running kernel includes commit 85ff9a0f793ca52c527e75cd40a69c948627ebde, execute iptables selftests, and verify absence of NFPROTO_UNSPEC registrations for affected matches/targets.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions
2. Obtain privileges to configure ebtables or issue setsockopt calls
3. Load rules that invoke UNSPEC-registered matches/targets
4. Trigger packet processing through the mismatched netfilter path
5. Observe kernel warnings or attempt to induce instability

How to detect it

Inspect kernel logs and dmesg for warnings referencing xt_cluster_mt, ebt_do_table, or NFPROTO_UNSPEC mismatches during netfilter processing.

• xt_cluster_mt+0x196/0x780
• ebt_do_table+0x174b/0x2a40
• WARNING: CPU:
• Module registers to NFPROTO_UNSPEC

What your security team should do

• Prioritize kernel updates to the fixed commit on all affected systems due to broad Linux ecosystem prevalence
• Audit custom netfilter configurations for UNSPEC family registrations
• Enable kernel warning logging and review for netfilter-related entries