Vulnerability · Published Jan 2, 2024 · Assigned by redhat

CVE-2024-0193Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

High 7.8

In plain English

A high-severity use-after-free in kernel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	linux	6.1.69-1	DEBIAN-CVE-2024-0193
Debian:13	linux	6.6.11-1	DEBIAN-CVE-2024-0193
Debian:14	linux	6.6.11-1	DEBIAN-CVE-2024-0193
Rocky Linux:9	kernel	0:5.14.0-362.24.1.el9_3.cloud.0.6	RXSA-2024:1248
Ubuntu:22.04:LTS	linux	5.15.0-92.102	USN-6609-1
Ubuntu:22.04:LTS	linux	5.15.0-92.102	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-aws	5.15.0-1052.57	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-aws	5.15.0-1052.57	USN-6609-1
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1018.18~22.04.1	USN-6608-1
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1018.18~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-aws-6.5	6.5.0-1012.12~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure	5.15.0-1054.62	USN-6607-1
Ubuntu:22.04:LTS	linux-azure	5.15.0-1054.62	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1019.19~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1019.19~22.04.1	USN-6608-1
Ubuntu:22.04:LTS	linux-azure-6.5	6.5.0-1011.11~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1054.62.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1054.62.1	USN-6607-1
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1019.19~22.04.1.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1019.19~22.04.1.1	USN-6608-1
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1049.57	USN-6609-1
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1049.57	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1021.23~22.04.1	USN-6635-1
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1021.23~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-gcp-6.5	6.5.0-1011.11~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-gke	5.15.0-1049.54	USN-6609-1
Ubuntu:22.04:LTS	linux-gke	5.15.0-1049.54	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1035.41	USN-6609-1
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1035.41	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-hwe-6.2	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-hwe-6.5	6.5.0-15.15~22.04.1	USN-6608-1
Ubuntu:22.04:LTS	linux-hwe-6.5	6.5.0-15.15~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1045.48	USN-6609-1
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1045.48	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1047.53	USN-6628-1
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1047.53	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1049.54	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1049.54	USN-6609-1
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-92.102	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.5	6.5.0-15.15.1.1~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.5	6.5.0-15.15.1.1~22.04.1	USN-6608-1
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1043.43	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1043.43	USN-6609-2
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1015.15	USN-6608-2
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1015.15	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-nvidia-6.5	6.5.0-1014.14	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1021.21	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1008.8	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oem-6.0	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1029.29	USN-6606-1
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1029.29	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1013.14	USN-6608-1
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1013.14	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1050.56	USN-6609-3
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1050.56	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-oracle-6.5	6.5.0-1014.14~22.04.1	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1045.48	USN-6609-1
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1045.48	UBUNTU-CVE-2024-0193
Ubuntu:24.04:LTS	linux-raspi	6.7.0-1001.1	UBUNTU-CVE-2024-0193
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-starfive-6.2	no fix listed	UBUNTU-CVE-2024-0193
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1027.31	UBUNTU-CVE-2024-0193

Affected products (as reported)

Vendor	Product	Versions
	kernel	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2024:1018 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1019 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1248 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2094 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4412 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4415 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-0193 vdb-entry, x_refsource_REDHAT
RHBZ#2255653 issue-tracking, x_refsource_REDHAT