HighFix available
netfilter: ipset: add missing range check in bitmap_ip_uadt
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.19.325, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.11.11, 6.12.2, 6.6.64
- CVEs
- CVE-2024-53141
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 04:20 UTC · Revision 1
Source evidence
netfilter: ipset: add missing range check in bitmap_ip_uadt
core-osv · Original sourcePublished 6 Dec 2024, 09:37 UTC
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.
osv:CVE-2024-53141
Kernel
Fixed versions: 4.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2
Complete source record
{
"id": "88a48e7e036eeaf0ceb9f22189536da23d122041a0b3e463f1c238fdbb375f87",
"url": "https://osv.dev/vulnerability/CVE-2024-53141",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "netfilter: ipset: add missing range check in bitmap_ip_uadt",
"summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.",
"evidence": "osv:CVE-2024-53141",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.19.325",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.287",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.231",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.174",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.120",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.64",
"evidence": "/affected/1/ranges"
},
{
"value": "6.11.11",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2024-53141",
"aliases": [
"CVE-2024-53141"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "72205fc68bd13109576aa6c4c12c740962d28a6c"
},
{
"fixed": "3c20b5948f119ae61ee35ad8584d666020c91581"
},
{
"fixed": "78b0f2028f1043227a8eb0c41944027fc6a04596"
},
{
"fixed": "2e151b8ca31607d14fddc4ad0f14da0893e1a7c7"
},
{
"fixed": "e67471437ae9083fa73fa67eee1573fec1b7c8cf"
},
{
"fixed": "7ffef5e5d5eeecd9687204a5ec2d863752aafb7e"
},
{
"fixed": "856023ef032d824309abd5c747241dffa33aae8c"
},
{
"fixed": "591efa494a1cf649f50a35def649c43ae984cd03"
},
{
"fixed": "15794835378ed56fb9bacc6a5dd3b9f33520604e"
},
{
"fixed": "35f56c554eb1b56b77b3cf197a6b00922d49033d"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53141.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.39"
},
{
"fixed": "4.19.325"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.287"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.231"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.174"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.120"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.64"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.11.11"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.12.0"
},
{
"fixed": "6.12.2"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53141.json"
}
}
],
"modified": "2026-10-28T02:30:33.304611796Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e",
"https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7",
"https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d",
"https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581",
"https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03",
"https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596",
"https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e",
"https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c",
"https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53141.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-53141",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53141.json"
}
},
"related_cves": [
{
"value": "CVE-2024-53141",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 500254,
"published_at": "2024-12-06T09:37:02.009+00:00"
}