CVE-2024-26851 netfilter: nf_conntrack_h323: Add protection for bmp length out of range

High 7.5 Published 17 Apr 2024 Updated 15 Oct 2026

A flaw in the Linux kernel's H.323 connection tracking allows a remote attacker to cause a denial of service via crafted network packets triggering an out-of-bounds shift.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-26851?

CVE-2024-26851 is a high-severity vulnerability in Debian Debian Linux, published on 17 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_h323: Add protection for bmp length out of range

UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type.

vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137>

Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.

Weakness: CWE-787

Which versions are affected by CVE-2024-26851?

It affects 2 products.

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2024-26851?

Apply the vendor's patch.

Is CVE-2024-26851 being exploited?

There is no known exploitation of CVE-2024-26851 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as BELL-CVE-2024-26851, DEBIAN-CVE-2024-26851, GHSA-w255-5hjq-7p69, UBUNTU-CVE-2024-26851.