Actively exploited · Published Jan 31, 2024 · Assigned by Google
CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables component
High 7.8 Exploited Ransomware
In plain English
A high-severity use-after-free in Kernel from Linux. Attackers are actively exploiting it in the wild (listed by CISA on May 30, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 28.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)28.1%top 1.9% of all CVEs
Exploited in the wildYesCISA KEV since May 30, 2024
Attack tooling1Public PoC
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 20, 2024.
Official description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | bpftool | 7.3.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-core | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-devel | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-doc | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-doc | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-modules | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-tools | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-core | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | libperf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | perf | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | python3-perf | 4.18.0-513.24.1.el8_9 | ALSA-2024:1607 |
| AlmaLinux:9 | python3-perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rtla | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rv | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| Debian:12 | linux | 6.1.76-1 | DEBIAN-CVE-2024-1086 |
| Debian:13 | linux | 6.6.15-1 | DEBIAN-CVE-2024-1086 |
| Debian:14 | linux | 6.6.15-1 | DEBIAN-CVE-2024-1086 |
| Rocky Linux:8 | kernel | 0:4.18.0-513.24.1.el8_9.cloud.0.1 | RXSA-2024:1607 |
| Rocky Linux:8 | kernel | 0:4.18.0-513.24.1.el8_9 | RLSA-2024:1607 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-513.24.1.rt7.326.el8_9 | RLSA-2024:1614 |
| Ubuntu:22.04:LTS | linux | 5.15.0-101.111 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux | 5.15.0-101.111 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1056.61 | USN-6705-1 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1056.61 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 6.5.0-1016.16~22.04.1 | USN-6707-3 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 6.5.0-1016.16~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1059.67 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1059.67 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1017.17~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1017.17~22.04.1 | USN-6707-4 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1059.67.1 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1059.67.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1054.62 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1054.62 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1016.16~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1016.16~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1053.58 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1053.58 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1039.45 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1039.45 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-26.26~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-26.26~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1049.52 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1049.52 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1051.57 | USN-6704-4 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1051.57 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1053.58 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1053.58 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-101.111 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-101.111 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-26.26.1~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-26.26.1~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1047.47 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1047.47 | USN-6704-1 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 6.5.0-1014.14 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1025.25 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1012.12 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1035.35 | USN-6688-1 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1035.35 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1018.19 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1018.19 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1054.60 | USN-6704-3 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1054.60 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1019.19~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1019.19~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1049.52 | USN-6704-2 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1049.52 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 6.5.0-26.26.1~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1010.11~22.04.1 | USN-6707-1 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1010.11~22.04.1 | UBUNTU-CVE-2024-1086 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1030.34 | UBUNTU-CVE-2024-1086 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 patch
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/
- https://github.com/Notselwyn/CVE-2024-1086
- https://news.ycombinator.com/item?id=39828424
- https://pwning.tech/nftables/
- http://www.openwall.com/lists/oss-security/2024/04/15/2
- http://www.openwall.com/lists/oss-security/2024/04/10/23
- http://www.openwall.com/lists/oss-security/2024/04/10/22
- http://www.openwall.com/lists/oss-security/2024/04/14/1
- http://www.openwall.com/lists/oss-security/2024/04/17/5
- https://security.netapp.com/advisory/ntap-20240614-0009/
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086 government-resource