Old Linux Kernel flaw CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-1086 | Use-After-Free Local Privilege Escalation in Linux Kernel nf_tables CVE-2024-1086 is a use-after-free vulnerability (CWE-416) in the Linux kernel's netfilter nf_tables component, tracked in CISA's catalog as a Linux Kernel Use-After-Free Vulnerability. A local attacker who can interact with the nf_tables netfilter subsystem can trigger the dangling memory reference to gain elevated privileges on the affected host. Successful exploitation yields local privilege escalation, effectively giving the attacker higher (typically root-level) access on an already-compromised machine. Any Linux system running a kernel with the affected nf_tables code is potentially impacted, which spans most modern server, cloud, and embedded Linux deployments. The flaw is being exploited in the wild: it was added to CISA KEV on 2024-05-30 with known ransomware use, and EPSS assigns a 28.1% probability of exploitation within 30 days (98th percentile). Do: Apply patched kernel updates from your Linux distribution or vendor as soon as they are available, prioritizing hosts listed in CISA KEV (federal agencies must act per the KEV deadline). Until patching, reduce exposure by limiting unprivileged users' ability to create user namespaces and interact with nf_tables, and confirm whether the nf_tables/netfilter modules are loaded on your systems. Because ransomware operators are using this flaw post-compromise, patching should precede or accompany ransomware-hardening reviews on Linux servers. | 7.8 | 28% | KEV ransomware PoC ×4 |
| masshundreds of millions of deployments (Linux is the default kernel across most servers, cloud instances, and embedded devices) |
Full article255 words · extracted from securityaffairs.com · click to collapse
CISA warns ransomware gangs exploit CVE-2024-1086, a Linux kernel flaw in netfilter: nf_tables, introduced in 2014 and patched in Jan 2024.
CISA warned that ransomware gangs are exploiting CVE-2024-1086, a high-severity Linux kernel flaw introduced in 2014 and patched in January 2024.
CISA didn’t provide details about the ransomware attacks exploiting the flaw or name the groups responsible for targeting it.
The vulnerability CVE-2024-1086 is a Linux kernel use-after-free issue that resides in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
In March 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog after the researcher “Notselwyn” published a detailed analysis and PoC exploit for the issue.
“When you try to reproduce the bug yourselves, the kernel may panic, even when all mitigations are disabled. This is because certain fields of the skb – such as pointers – get corrupted when the skb is freed. As such, we should try to avoid usage of these fields.” wrote Notselwyn. “Fortunately, I found a way to bypass all usage which could lead to a panic or usual errors and get a highly reliable double-free primitive. I’m highlighting this in the respective subsection within the proof-of-concept section.”
The researchers demonstrated local privilege escalation on Linux kernels 5.14–6.6. The flaw affects major distributions like Debian, Ubuntu, Fedora, and Red Hat, impacting kernel versions from 3.15 up to 6.8-rc1.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/184076/security/old-linux-kernel-flaw-cve-2024-1086-resurfaces-in-ransomware-attacks.html