LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This makes pipapo find an incorrect matching results for sets where first field size is not the largest. Followup patch adds a test case to nft_concat_range.sh selftest script. Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn't enough.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can make nftables packet matching return the wrong result in some set configurations. Business impact depends on whether affected systems rely on netfilter/nftables for access control, filtering, or traffic handling. The public record does not provide CVSS, CWE, or confirmed exploitation.

Executive priority

Treat as a targeted kernel maintenance issue until severity is clarified. Prioritize internet-facing or boundary systems that depend on Linux nftables for firewall decisions, but avoid emergency escalation without vendor severity, CVSS, or exploitation evidence.

Technical view

The issue is in netfilter nf_set_pipapo initial map filling. The fill buffer used all-ones beyond the first field size, allowing bits to carry into later search rounds. For sets whose first field is not the largest, pipapo can report incorrect matches.

Likely exposure

Exposure is most relevant to Linux systems using nftables/netfilter set matching, especially pipapo-backed sets with differing field sizes. The CVE record lists Linux kernel versions and stable branches as affected, but the bundle does not provide a simple distribution-level package matrix.

Exploitation context

The source bundle states KEV is false and provides no evidence of active exploitation or public weaponization. The described outcome is incorrect packet or set matching, not a memory-corruption primitive in the supplied text.

Researcher notes

Key behavior is logical match corruption in nf_set_pipapo when the first field size is smaller than the maximum map size. The source mentions a follow-up selftest in nft_concat_range.sh, suggesting regression validation around concatenated range matching.

Mitigation direction

  • Update affected Linux kernels through vendor-supported packages or stable kernels containing the referenced fixes.
  • Check distribution security advisories for backported fixes before relying on upstream version numbers.
  • Prioritize systems where nftables enforces security boundaries or traffic filtering.
  • Avoid assuming exploitability details beyond the incorrect-match behavior described in the CVE record.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, containers hosts, and network filtering nodes.
  • Confirm whether systems use nftables/netfilter sets that could exercise pipapo matching.
  • Verify installed kernels include a vendor fix or one of the referenced stable commits.
  • Track remediation evidence through package changelogs, kernel build metadata, or vendor advisories.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57947 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c4287f62044a90e73a561aa05fc46e62da173da, 3c4287f62044a90e73a561aa05fc46e62da173da, 3c4287f62044a90e73a561aa05fc46e62da173da, 3c4287f62044a90e73a561aa05fc46e62da173da, 3c4287f62044a90e73a561aa05fc46e62da173da, 3c4287f62044a90e73a561aa05fc46e62da173daunaffected
LinuxLinux5.6, 0, 5.10.247, 5.15.165, 6.1.103, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.