Linux Kernel netfilter nf_tables Use-After-Free CA PrivEsc via NF_DROP
CVE-2024-1086 Published on January 31, 2024
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Known Exploited Vulnerability
This Linux Kernel Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
The following remediation steps are recommended / required by June 20, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2024-1086 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2024-1086 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2024-1086
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-1086 are published in these products:
Affected Versions
Linux Kernel:- Version 3.15 and below 6.8 is affected.
- Version 3.15 and below 6.8 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.