CVE-2024-1086

CVE-2024-1086 is a high-severity (CVSS 7.8) vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on May 30, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 20, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Linux has 32 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• http://www.openwall.com/lists/oss-security/2024/04/10/22
• http://www.openwall.com/lists/oss-security/2024/04/10/23
• http://www.openwall.com/lists/oss-security/2024/04/14/1
• http://www.openwall.com/lists/oss-security/2024/04/15/2
• http://www.openwall.com/lists/oss-security/2024/04/17/5
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
• https://github.com/Notselwyn/CVE-2024-1086
• https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660