CVE-2024-57947
A flaw in the Linux kernel’s netfilter nf_set_pipapo component allowed incorrect matching of packet filtering sets. The bug caused bits from a smaller field to leak into future rounds, potentially letting attackers bypass or misdirect traffic. The issue has been fixed in a kernel patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (netfilter nf_set_pipapo) – all distributions using the affected kernel version.
Real-world impact
An attacker could craft packets that exploit the faulty set matching, allowing traffic to slip through firewall rules or be redirected to unintended destinations, compromising confidentiality, integrity, and availability of network services.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability requires no authentication or user interaction, yet it can fully compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 011. Verify your current Linux kernel version.
- 022. Update to the latest kernel release that includes the netfilter nf_set_pipapo fix (e.g., via your distribution’s package manager).
- 033. Reboot the system to load the updated kernel.
NVD description indicates the vulnerability has been resolved
Timeline
- Jan 23, 2025 · Jan 23, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.