CVE-2024-1086

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1086
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/10/22 Mailing List Patch
http://www.openwall.com/lists/oss-security/2024/04/10/23 Mailing List Patch
http://www.openwall.com/lists/oss-security/2024/04/14/1 Exploit Mailing List
http://www.openwall.com/lists/oss-security/2024/04/15/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/04/17/5 Exploit Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 Mailing List Patch
https://github.com/Notselwyn/CVE-2024-1086 Exploit Third Party Advisory
https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ Mailing List
https://news.ycombinator.com/item?id=39828424 Issue Tracking
https://pwning.tech/nftables/ Exploit Technical Description Third Party Advisory
https://security.netapp.com/advisory/ntap-20240614-0009/
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
History

14 Jun 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240614-0009/ -

07 Jun 2024, 13:25

Type Values Removed Values Added
First Time Fedoraproject fedora
Fedoraproject
Redhat enterprise Linux For Power Little Endian
Redhat enterprise Linux Desktop
Redhat enterprise Linux Server
Redhat enterprise Linux Workstation
Redhat enterprise Linux For Power Big Endian
Redhat
Redhat enterprise Linux For Ibm Z Systems
CPE cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
References () http://www.openwall.com/lists/oss-security/2024/04/10/22 - () http://www.openwall.com/lists/oss-security/2024/04/10/22 - Mailing List, Patch
References () http://www.openwall.com/lists/oss-security/2024/04/10/23 - () http://www.openwall.com/lists/oss-security/2024/04/10/23 - Mailing List, Patch
References () http://www.openwall.com/lists/oss-security/2024/04/14/1 - () http://www.openwall.com/lists/oss-security/2024/04/14/1 - Exploit, Mailing List
References () http://www.openwall.com/lists/oss-security/2024/04/15/2 - () http://www.openwall.com/lists/oss-security/2024/04/15/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2024/04/17/5 - () http://www.openwall.com/lists/oss-security/2024/04/17/5 - Exploit, Mailing List
References () https://github.com/Notselwyn/CVE-2024-1086 - () https://github.com/Notselwyn/CVE-2024-1086 - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ - Mailing List
References () https://news.ycombinator.com/item?id=39828424 - () https://news.ycombinator.com/item?id=39828424 - Issue Tracking
References () https://pwning.tech/nftables/ - () https://pwning.tech/nftables/ - Exploit, Technical Description, Third Party Advisory

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/10/22 -
  • () http://www.openwall.com/lists/oss-security/2024/04/10/23 -
  • () http://www.openwall.com/lists/oss-security/2024/04/14/1 -
  • () http://www.openwall.com/lists/oss-security/2024/04/15/2 -
  • () http://www.openwall.com/lists/oss-security/2024/04/17/5 -

26 Mar 2024, 18:15

Type Values Removed Values Added
References
  • () https://pwning.tech/nftables/ -

26 Mar 2024, 17:15

Type Values Removed Values Added
References
  • () https://github.com/Notselwyn/CVE-2024-1086 -
  • () https://news.ycombinator.com/item?id=39828424 -

06 Feb 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ -

05 Feb 2024, 20:41

Type Values Removed Values Added
References () https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 - () https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 - Mailing List, Patch
References () https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 - () https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
Summary
  • (es) Una vulnerabilidad de use after free en el componente netfilter: nf_tables del kernel de Linux puede explotarse para lograr una escalada de privilegios local. La función nft_verdict_init() permite valores positivos como error de eliminación dentro del veredicto del gancho y, por lo tanto, la función nf_hook_slow() puede causar una vulnerabilidad double free cuando NF_DROP se emite con un error de eliminación similar a NF_ACCEPT. Recomendamos actualizar después del compromiso f342de4e2f33e0e39165d8639387aa6c19dff660.

31 Jan 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-31 13:15

Updated : 2024-06-14 13:15

NVD link : CVE-2024-1086

Mitre link : CVE-2024-1086

CVE.ORG link : CVE-2024-1086

JSON object : View

Products Affected

fedoraproject

  • fedora

redhat

  • enterprise_linux_server
  • enterprise_linux_desktop
  • enterprise_linux_for_power_little_endian
  • enterprise_linux_for_power_big_endian
  • enterprise_linux_workstation
  • enterprise_linux_for_ibm_z_systems

linux

  • linux_kernel
CWE
CWE-416

Use After Free