CVE-2024-1086KEV · OVERDUECWE-416

Linux Kernel Use-After-Free Vulnerability

High · published January 31, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.1th percentile for exploit probability.

856
days past CISA
deadline
CVSS v3.1
7.8
EPSS
28%
Percentile
98.1
In the wild
Confirmed
What it is

⚡ A sneaky use-after-free vulnerability in the Linux kernel's netfilter component can open the door for local privilege escalation! 🌐 Think of it like a restaurant where the staff keeps dropping and picking up the same order without realizing they already served it — chaos ensues when they try to serve the same dish twice, and anyone can claim it! An attacker could exploit this flaw to gain elevated privileges, allowing them to execute arbitrary code with kernel-level access. This is absolutely devastating, as it could lead to complete control over the system and compromise sensitive data.

Put simply

Think of it like a restaurant where the staff keeps dropping and picking up the same order without realizing they already served it — chaos ensues when they try to serve the same dish twice, and anyone can claim it! In the nft_verdict_init() function, allowing positive values as drop errors can trigger a double free when NF_DROP is issued, causing a use-after-free scenario that enables privilege escalation through the nf_hook_slow() function.

What to do

An attacker could exploit this flaw to gain elevated privileges, allowing them to execute arbitrary code with kernel-level access. This is absolutely devastating, as it could lead to complete control over the system and compromise sensitive data. Upgrade your kernel to a version beyond commit f342de4e2f33e0e39165d8639387aa6c19dff660 immediately. Review your security settings and audit your systems to ensure no unauthorized access has been granted due to this vulnerability. You've got this! By following these steps, you'll bolster your defenses and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.28058 · 98.1th percentile
Weakness
CWE-416 · Use After Free
Published
2024-01-31T18:15Z
KEV added
2024-05-30 · due 2024-06-20
Affected products (22)
ProductVersionsFixed in
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h410s_firmwareall versions—
netapp/h410c_firmwareall versions—
netapp/bootstrap_osall versions—
linux/linux_kernel≥ 3.15, < 5.15.1495.15.149
linux/linux_kernel≥ 6.1, < 6.1.766.1.76
linux/linux_kernel≥ 6.2, < 6.6.156.6.15
linux/linux_kernel≥ 6.7, < 6.7.36.7.3
linux/linux_kernelall versions—
fedoraproject/fedoraall versions—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_for_ibm_z_systemsall versions—
redhat/enterprise_linux_for_power_big_endianall versions—
redhat/enterprise_linux_for_power_little_endianall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_workstationall versions—
debian/debian_linuxall versions—
netapp/a250_firmwareall versions—
netapp/500f_firmwareall versions—
netapp/c250_firmwareall versions—
References (29)
http://www.openwall.com/lists/oss-security/2024/04/10/22 · [email protected]http://www.openwall.com/lists/oss-security/2024/04/10/23 · [email protected]http://www.openwall.com/lists/oss-security/2024/04/14/1 · [email protected]http://www.openwall.com/lists/oss-security/2024/04/15/2 · [email protected]http://www.openwall.com/lists/oss-security/2024/04/17/5 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 · [email protected]https://github.com/Notselwyn/CVE-2024-1086 · [email protected]https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 · [email protected]https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html · [email protected]https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ · [email protected]https://news.ycombinator.com/item?id=39828424 · [email protected]https://pwning.tech/nftables/ · [email protected]https://security.netapp.com/advisory/ntap-20240614-0009/ · [email protected]http://www.openwall.com/lists/oss-security/2024/04/10/22 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/10/23 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/14/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/15/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/17/5 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 · af854a3a-2127-422b-91ae-364da2661108https://github.com/Notselwyn/CVE-2024-1086 · af854a3a-2127-422b-91ae-364da2661108https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ · af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=39828424 · af854a3a-2127-422b-91ae-364da2661108https://pwning.tech/nftables/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240614-0009/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 20
    kev
  • 31 JAN 12:14Z
    Use-after-free in Linux kernel's netfilter: nf_tables component
    cvelistv5