Linux Kernel up to 6.7 Netfilter nf_tables_api.c nft_setelem_catchall_deactivate use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.7. It has been classified as critical. The affected element is the function nft_setelem_catchall_deactivate of the file net/netfilter/nf_tables_api.c of the component Netfilter. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2024-1085. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.7 (Operating System). It has been rated as critical. This issue affects the function nft_setelem_catchall_deactivate of the file net/netfilter/nf_tables_api.c of the component Netfilter. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

The weakness was disclosed 01/31/2024 by Lonial Con. It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2024-1085 since 01/30/2024. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/31/2024).

Upgrading to version 6.8 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion