use-after-free in netfilter: nf_tables (CVE-2024-1086) #shorts #breaking

CVE

This vulnerability is a use-after-free flaw in the netfilter: nf_tables of the Linux kernel. Discovered less than a month ago, it is categorized as a zero-day exploit, meaning it is being actively exploited before a patch was available. Predominantly targeting federal agencies, this vulnerability impacts Linux kernel versions ranging from 3.15 up to, but not including, 6.8. Attackers exploiting this vulnerability can achieve local privilege escalation, allowing them to execute commands with elevated permissions. This issue necessitates urgent attention from users and administrators who run the affected Linux versions.

Watch the full video on YouTube: CVE-2024-1086

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2024-1086
Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Provider
Google
CWE / problem types
CWE-416 Use After Free
Affected Software Versions
Linux:Kernel:[{'status': 'affected', 'version': '3.15', 'lessThan': '6.8', 'versionType': 'custom'}]
Date Published
2024-01-31T12:14:34.073Z
Last Updated
2025-02-13T17:27:33.953Z