Federal agency warns critical Linux vulnerability being actively exploited
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-1086 | Use-After-Free Local Privilege Escalation in Linux Kernel nf_tables CVE-2024-1086 is a use-after-free vulnerability (CWE-416) in the Linux kernel's netfilter nf_tables component, tracked in CISA's catalog as a Linux Kernel Use-After-Free Vulnerability. A local attacker who can interact with the nf_tables netfilter subsystem can trigger the dangling memory reference to gain elevated privileges on the affected host. Successful exploitation yields local privilege escalation, effectively giving the attacker higher (typically root-level) access on an already-compromised machine. Any Linux system running a kernel with the affected nf_tables code is potentially impacted, which spans most modern server, cloud, and embedded Linux deployments. The flaw is being exploited in the wild: it was added to CISA KEV on 2024-05-30 with known ransomware use, and EPSS assigns a 28.1% probability of exploitation within 30 days (98th percentile). Do: Apply patched kernel updates from your Linux distribution or vendor as soon as they are available, prioritizing hosts listed in CISA KEV (federal agencies must act per the KEV deadline). Until patching, reduce exposure by limiting unprivileged users' ability to create user namespaces and interact with nf_tables, and confirm whether the nf_tables/netfilter modules are loaded on your systems. Because ransomware operators are using this flaw post-compromise, patching should precede or accompany ransomware-hardening reviews on Linux servers. | 7.8 | 28% | KEV ransomware PoC ×4 |
| masshundreds of millions of deployments (Linux is the default kernel across most servers, cloud instances, and embedded devices) |
Full article194 words · extracted from arstechnica.com · click to collapse
The US Cybersecurity and Infrastructure Security Agency has added a critical security bug in Linux to its list of vulnerabilities known to be actively exploited in the wild.
The vulnerability, tracked as CVE-2024-1086 and carrying a severity rating of 7.8 out of a possible 10, allows people who have already gained a foothold inside an affected system to escalate their system privileges. It’s the result of a use-after-free error, a class of vulnerability that occurs in software written in the C and C++ languages when a process continues to access a memory location after it has been freed or deallocated. Use-after-free vulnerabilities can result in remote code or privilege escalation.
The vulnerability, which affects Linux kernel versions 5.14 through 6.6, resides in the NF_tables, a kernel component enabling the Netfilter, which in turn facilitates a variety of network operations, including packet filtering, network address [and port] translation (NA[P]T), packet logging, userspace packet queueing, and other packet mangling. It was patched in January, but as the CISA advisory indicates, some production systems have yet to install it. At the time this Ars post went live, there were no known details about the active exploitation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2024/05/federal-agency-warns-critical-linux-vulnerability-being-actively-exploited/