CVE-2024-1086

Опубликовано: 31 янв. 2024

Источник: nvd

CVSS3: 7.8

EPSS Высокий

Описание

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Ссылки

http://www.openwall.com/lists/oss-security/2024/04/10/22
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2024/04/10/23
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2024/04/14/1
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/15/2
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/17/5
Exploit
Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
Patch
https://github.com/Notselwyn/CVE-2024-1086
Exploit
Third Party Advisory
https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/
Mailing List
https://news.ycombinator.com/item?id=39828424
Issue Tracking
https://pwning.tech/nftables/
Exploit
Technical Description
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240614-0009/
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/10/22
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2024/04/10/23
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2024/04/14/1
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/15/2
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/17/5
Exploit
Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 3.15 (включая) до 5.15.149 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.1 (включая) до 6.1.76 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.6.15 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.7 (включая) до 6.7.3 (исключая)

cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.849

Высокий

7.8 High

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVE-2024-1086

CVSS3: 7.8

ubuntu

больше 1 года назад

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2024-1086

CVSS3: 7.8

redhat

больше 1 года назад

CVE-2024-1086

CVSS3: 7.8

msrc

больше 1 года назад

Описание отсутствует

CVE-2024-1086

CVSS3: 7.8

debian

больше 1 года назад

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tab ...

SUSE-SU-2024:1401-1

suse-cvrf

около 1 года назад

Security update for the Linux Kernel (Live Patch 52 for SLE 12 SP5)

EPSS

Процентиль: 99%

0.849

Высокий

7.8 High

CVSS3

Дефекты

CWE-416