Security readout for executives and security teams
Plain-English summary
A Linux nftables rollback bug can leave internal references and element state inconsistent when deleting a set fails. The supplied record describes warnings and a memory leak; its CVSS assessment also indicates potentially serious confidentiality, integrity, and availability impact from local exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on shared systems with local user access. Use an accelerated but controlled update cycle. The supplied evidence does not justify declaring an active incident or an emergency remote-exploitation event.
Technical view
The nf_tables abort path used a set iterator that skipped next-generation inactive elements, preventing nft_mapelem_activate() from correctly restoring reference counters. The fix moves filtering into the callback, reverses selection during activation, toggles generation state during deletion, and invokes nft_clear() during rollback.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and reaching the relevant nf_tables set-deletion path. The CVSS vector identifies local, low-privilege access rather than remote exploitation. Supplied version metadata is difficult to interpret reliably, so confirm exposure using distribution advisories and stable-kernel commit ancestry.
Exploitation context
The CVSS vector rates exploitation as local, low complexity, requiring low privileges and no user interaction. The bundle contains no cited public exploit or confirmed exploitation, and KEV is false. Active exploitation is therefore not established by the supplied evidence.
Researcher notes
The record directly supports an abort-path state-restoration defect, reference-count inconsistency, warnings, and a mapping-object memory leak. It does not document an exploitation chain proving the CVSS confidentiality, integrity, and availability impacts. Downstream version status should be established from vendor advisories or commit ancestry because the bundled version list is ambiguous.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Consult distribution advisories to identify the corrected package for each deployed kernel branch.
- Accelerate updates on systems accessible to untrusted or numerous local users.
- Reduce unnecessary local account access while affected systems await maintenance.
Validation and detection
- Record each system's running kernel version, not only its installed package version.
- Compare downstream kernel patches with the referenced stable-kernel commits.
- Reboot updated systems and verify the corrected kernel is active.
- Review kernel logs for nf_tables warnings or related memory-leak symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2cf64b16ac55c42c8989d8c819e42a77549cd680CVE reference, Linux
- https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14CVE reference, Linux
- https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637CVE reference, Linux
- https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382edCVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.