Log in Start free

Vulnerability · Published Jul 3, 2024 · Assigned by Google

CVE-2024-6284Improper IPv4 and IPv6 byte order storage in github.com/google/nftables

Medium 6.3

In plain English

A medium-severity security flaw in https://github.com/google/nftables from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.3%top 78.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In https://github.com/google/nftables  IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects:  https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was fixed in the next released version:  https://pkg.go.dev/github.com/google/nftables@v0.2.0

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-google-nftables0.1.0-4~deb12u1DEBIAN-CVE-2024-6284
Debian:13golang-github-google-nftables0.1.0-4DEBIAN-CVE-2024-6284
Debian:14golang-github-google-nftables0.1.0-4DEBIAN-CVE-2024-6284
Gogithub.com/google/nftables0.2.0GHSA-qjvf-8748-9w7h
Gogithub.com/google/nftables0.2.0GO-2024-2977
Ubuntu:24.04:LTSgolang-github-google-nftablesno fix listedUBUNTU-CVE-2024-6284

Affected products (as reported)

VendorProductVersions
Google https://github.com/google/nftables 0.1.0

Weakness: CWE-1286, CWE-1389 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

References