Vulnerability · Published Jan 31, 2024 · Assigned by Google
CVE-2024-1085Use-after-free in Linux kernel's netfilter: nf_tables component
High 7.8
In plain English
A high-severity use-after-free in Kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | bpftool | 7.3.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-doc | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-tools | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | libperf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | python3-perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rtla | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rv | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| Debian:12 | linux | 6.1.76-1 | DEBIAN-CVE-2024-1085 |
| Debian:13 | linux | 6.6.15-1 | DEBIAN-CVE-2024-1085 |
| Debian:14 | linux | 6.6.15-1 | DEBIAN-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux | 5.15.0-101.111 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux | 5.15.0-101.111 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1056.61 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1056.61 | USN-6705-1 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 6.5.0-1016.16~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 6.5.0-1016.16~22.04.1 | USN-6707-3 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1059.67 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1059.67 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1017.17~22.04.1 | USN-6707-4 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1017.17~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1059.67.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1059.67.1 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1054.62 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1054.62 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1016.16~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1016.16~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1053.58 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1053.58 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1039.45 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1039.45 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-26.26~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-26.26~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1049.52 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1049.52 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1051.57 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1051.57 | USN-6704-4 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1053.58 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1053.58 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-101.111 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-101.111 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-26.26.1~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-26.26.1~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1047.47 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1047.47 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 6.5.0-1014.14 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1025.25 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1012.12 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1035.35 | USN-6688-1 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1035.35 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1018.19 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1018.19 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1054.60 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1054.60 | USN-6704-3 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1019.19~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1019.19~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1049.52 | USN-6704-2 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1049.52 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 6.5.0-26.26.1~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1010.11~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1010.11~22.04.1 | UBUNTU-CVE-2024-1085 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1030.34 | UBUNTU-CVE-2024-1085 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H