One straggler CVE for 6.7.4 assigned

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

4 files changed, 240 insertions, 0 deletions

diff --git a/cve/reserved/2024/CVE-2024-26673 b/cve/published/2024/CVE-2024-26673
index e69de29b..e69de29b 100644
--- a/cve/reserved/2024/CVE-2024-26673
+++ b/cve/published/2024/CVE-2024-26673
diff --git a/cve/published/2024/CVE-2024-26673.json b/cve/published/2024/CVE-2024-26673.json
new file mode 100644
index 00000000..0da011aa
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26673.json
@@ -0,0 +1,163 @@
+{
+   "containers": {
+      "cna": {
+         "providerMetadata": {
+            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
+         },
+         "descriptions": [
+            {
+               "lang": "en",
+               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations\n\n- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.\n- Disallow layer 4 protocol with no ports, since destination port is a\n  mandatory attribute for this object."
+            }
+         ],
+         "affected": [
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "unaffected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "f549f340c91f",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "65ee90efc928",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "b775ced05489",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "0f501dae16b7",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "cfe3550ea5df",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "38cc1605338d",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "857b46027d6f",
+                     "lessThan": "8059918a1377",
+                     "status": "affected",
+                     "versionType": "git"
+                  }
+               ]
+            },
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "affected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "5.3",
+                     "status": "affected"
+                  },
+                  {
+                     "version": "0",
+                     "lessThan": "5.3",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.4.269",
+                     "lessThanOrEqual": "5.4.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.10.210",
+                     "lessThanOrEqual": "5.10.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.15.149",
+                     "lessThanOrEqual": "5.15.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.1.77",
+                     "lessThanOrEqual": "6.1.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.6.16",
+                     "lessThanOrEqual": "6.6.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.7.4",
+                     "lessThanOrEqual": "6.7.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.8",
+                     "lessThanOrEqual": "*",
+                     "status": "unaffected",
+                     "versionType": "original_commit_for_fix"
+                  }
+               ]
+            }
+         ],
+         "references": [
+            {
+               "url": "https://git.kernel.org/stable/c/f549f340c91f08b938d60266e792ff7748dae483"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/65ee90efc928410c6f73b3d2e0afdd762652c09d"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/b775ced05489f4b77a35fe203e9aeb22f428e38f"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/0f501dae16b7099e69ee9b0d5c70b8f40fd30e98"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/cfe3550ea5df292c9e2d608e8c4560032391847e"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/38cc1605338d99205a263707f4dde76408d3e0e8"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/8059918a1377f2f1fff06af4f5a4ed3d5acd6bc4"
+            }
+         ],
+         "title": "netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations",
+         "x_generator": {
+            "engine": "bippy-b4257b672505"
+         }
+      }
+   },
+   "cveMetadata": {
+      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
+      "cveID": "CVE-2024-26673",
+      "requesterUserId": "gregkh@kernel.org",
+      "serial": "1",
+      "state": "PUBLISHED"
+   },
+   "dataType": "CVE_RECORD",
+   "dataVersion": "5.0"
+}
diff --git a/cve/published/2024/CVE-2024-26673.mbox b/cve/published/2024/CVE-2024-26673.mbox
new file mode 100644
index 00000000..21a98587
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26673.mbox
@@ -0,0 +1,76 @@
+From bippy-b4257b672505 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+To: <linux-cve-announce@vger.kernel.org>
+Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
+Subject: CVE-2024-26673: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
+Message-Id: <2024040212-CVE-2024-26673-b2d3@gregkh>
+Content-Length: 2638
+Lines: 59
+X-Developer-Signature: v=1; a=openpgp-sha256; l=2698;
+ i=gregkh@linuxfoundation.org; h=from:subject:message-id;
+ bh=4ot3XRqWCsz/tSBYwma+lRfKGxNHLSGIl5JeyJk3qFM=;
+ b=kA0DAAIRMUfUDdst+ykByyZiAGYLquCiPEtpvLEwAMTlkSMODeH4vN3kWevf8u9nOP+6R2UXI
+ IhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmYLquAACgkQMUfUDdst+yk7vwCggw5M
+ 5nELr+x06NNxPgA8+P8/HvsAoKNrG6Kpl76pUrirZKaWjjmNbfed
+X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp;
+ fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29
+
+Description
+===========
+
+In the Linux kernel, the following vulnerability has been resolved:
+
+netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
+
+- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.
+- Disallow layer 4 protocol with no ports, since destination port is a
+  mandatory attribute for this object.
+
+The Linux kernel CVE team has assigned CVE-2024-26673 to this issue.
+
+
+Affected and fixed versions
+===========================
+
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 5.4.269 with commit f549f340c91f
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 5.10.210 with commit 65ee90efc928
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 5.15.149 with commit b775ced05489
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 6.1.77 with commit 0f501dae16b7
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 6.6.16 with commit cfe3550ea5df
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 6.7.4 with commit 38cc1605338d
+	Issue introduced in 5.3 with commit 857b46027d6f and fixed in 6.8 with commit 8059918a1377
+
+Please see https://www.kernel.org for a full list of currently supported
+kernel versions by the kernel community.
+
+Unaffected versions might change over time as fixes are backported to
+older supported kernel versions.  The official CVE entry at
+	https://cve.org/CVERecord/?id=CVE-2024-26673
+will be updated if fixes are backported, please check that for the most
+up to date information about this issue.
+
+
+Affected files
+==============
+
+The file(s) affected by this issue are:
+	net/netfilter/nft_ct.c
+
+
+Mitigation
+==========
+
+The Linux kernel CVE team recommends that you update to the latest
+stable kernel version for this, and many other bugfixes.  Individual
+changes are never tested alone, but rather are part of a larger kernel
+release.  Cherry-picking individual commits is not recommended or
+supported by the Linux kernel community at all.  If however, updating to
+the latest release is impossible, the individual changes to resolve this
+issue can be found at these commits:
+	https://git.kernel.org/stable/c/f549f340c91f08b938d60266e792ff7748dae483
+	https://git.kernel.org/stable/c/65ee90efc928410c6f73b3d2e0afdd762652c09d
+	https://git.kernel.org/stable/c/b775ced05489f4b77a35fe203e9aeb22f428e38f
+	https://git.kernel.org/stable/c/0f501dae16b7099e69ee9b0d5c70b8f40fd30e98
+	https://git.kernel.org/stable/c/cfe3550ea5df292c9e2d608e8c4560032391847e
+	https://git.kernel.org/stable/c/38cc1605338d99205a263707f4dde76408d3e0e8
+	https://git.kernel.org/stable/c/8059918a1377f2f1fff06af4f5a4ed3d5acd6bc4
diff --git a/cve/published/2024/CVE-2024-26673.sha1 b/cve/published/2024/CVE-2024-26673.sha1
new file mode 100644
index 00000000..6a0287f7
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26673.sha1
@@ -0,0 +1 @@
+8059918a1377f2f1fff06af4f5a4ed3d5acd6bc4