CVE-2024-57947

What it actually does

The nf_set_pipapo map initialization in the Linux kernel netfilter incorrectly sets the initial all-ones buffer only to the size of the first field instead of properly restricting and zeroing remainders, allowing one-bits to leak across swapped result/fill maps in subsequent search rounds for sets whose first field bsize is smaller than bsize_max, producing false-positive matches.

Why it matters to the business

Systems relying on nftables or netfilter sets with concatenated ranges may apply incorrect packet decisions, leading to unintended traffic allowing or blocking that affects security policy enforcement and network operations on affected Red Hat kernels.

How an attack unfolds

An attacker crafts network packets targeting a netfilter set whose first field is not the widest; the leaked bits cause the pipapo lookup to erroneously report a match, bypassing intended drop/reject rules or triggering unintended accept actions without authentication or special privileges.

How to fix it

Update all affected kernel packages on Red Hat Enterprise Linux AUS 7.2 to version 0:3.10.0-327.100.1.el7 or later; for source-based deployments apply commit 77bf0c4ab928ca4c9a99311f4f70ba0c17fecba9 and rebuild.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed release, verify the selftest nft_concat_range.sh passes, and test rule sets with mixed field widths to ensure expected match behavior.

Typical attack path

1. Identify a target system using nftables sets with concatenated fields where the first field size is smaller than subsequent fields.
2. Send crafted packets whose headers trigger the pipapo search path.
3. Observe or leverage the resulting incorrect match decision to reach protected resources or evade filtering.

How to detect it

Examine system logs for unexpected packet acceptance or drops inconsistent with nftables rules; inspect netfilter set lookup traces or packet captures around the time of anomalous connectivity; no public exploit artifacts are known.

What your security team should do

• Prioritize patching kernel packages on all internet-facing or security-critical systems within the published remediation window.
• Review nftables rule sets containing concat ranges and test for behavioral changes after upgrade.
• Monitor vendor advisories for additional backports to older kernel streams.