CVE-2024-6284

Summary

In https://github.com/google/nftables  IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses).

This issue affects:  https://pkg.go.dev/github.com/google/nftables@v0.1.0

The bug was fixed in the next released version:  https://pkg.go.dev/github.com/google/nftables@v0.2.0

Affected Software

VendorProductVersion RangeStatus
Googlehttps://github.com/google/nftables0.1.0affected
Googlehttps://github.com/google/nftables0.2.0unaffected

Weaknesses

  • CWE-1286: CWE-1286 Improper Validation of Syntactic Correctness of Input
  • CWE-1389: CWE-1389 Incorrect Parsing of Numbers with Different Radices

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References