CVE-2024-1086
Last modified
CVE-2024-1086 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.. CISA has confirmed active exploitation in the wild. EPSS estimates a 28.06% chance of exploitation in the next 30 days.
Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | >= 3.15, < 5.15.149 | — |
| Linux | Linux Kernel | >= 6.1, < 6.1.76 | — |
| Linux | Linux Kernel | >= 6.2, < 6.6.15 | — |
| Linux | Linux Kernel | >= 6.7, < 6.7.3 | — |
| Linux | Linux Kernel | 6.8 | Rc1 |
| Fedoraproject | Fedora | 39 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux For Ibm Z Systems | 7.0_s390x | — |
| Redhat | Enterprise Linux For Power Big Endian | 7.0_ppc64 | — |
| Redhat | Enterprise Linux For Power Little Endian | 7.0_ppc64le | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Workstation | 7.0 | — |
| Debian | Debian Linux | 10.0 | — |
| Netapp | A250 Firmware | All versions | — |
| Netapp | 500f Firmware | All versions | — |
| Netapp | C250 Firmware | All versions | — |
References
- http://www.openwall.com/lists/oss-security/2024/04/10/22Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/10/23Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/14/1Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/17/5Exploit, Mailing List
- https://github.com/Notselwyn/CVE-2024-1086Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=39828424Issue Tracking
- https://pwning.tech/nftables/Exploit, Technical Description, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/04/10/22Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/10/23Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/14/1Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/17/5Exploit, Mailing List
- https://github.com/Notselwyn/CVE-2024-1086Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=39828424Issue Tracking
- https://pwning.tech/nftables/Exploit, Technical Description, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-1086?
How severe is CVE-2024-1086?
How do I fix CVE-2024-1086?
Are you affected by CVE-2024-1086?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST