CISA Alerts Federal Agencies to Patch Actively Exploited Linux Kernel Flaw

CVE-2024-1086 is a use-after-free vulnerability (CWE-416) in the Linux kernel's netfilter nf_tables component, tracked in CISA's catalog as a Linux Kernel Use-After-Free Vulnerability. A local attacker who can interact with the nf_tables netfilter subsystem can trigger the dangling memory reference to gain elevated privileges on the affected host. Successful exploitation yields local privilege escalation, effectively giving the attacker higher (typically root-level) access on an already-compromised machine. Any Linux system running a kernel with the affected nf_tables code is potentially impacted, which spans most modern server, cloud, and embedded Linux deployments. The flaw is being exploited in the wild: it was added to CISA KEV on 2024-05-30 with known ransomware use, and EPSS assigns a 28.1% probability of exploitation within 30 days (98th percentile).

Do: Apply patched kernel updates from your Linux distribution or vendor as soon as they are available, prioritizing hosts listed in CISA KEV (federal agencies must act per the KEV deadline). Until patching, reduce exposure by limiting unprivileged users' ability to create user namespaces and interact with nf_tables, and confirm whether the nf_tables/netfilter modules are loaded on your systems. Because ransomware operators are using this flaw post-compromise, patching should precede or accompany ransomware-hardening reviews on Linux servers.

Check Point Quantum Security Gateways contain an information disclosure flaw (CWE-200) that can expose information stored on the appliance to unauthorized parties. It is triggered when an attacker targets a gateway connected to the internet with IPSec VPN, Remote Access VPN, or Mobile Access enabled, sending crafted requests to the exposed VPN services. A successful attacker gains unauthorized access to information on the gateway, and CISA notes known use of this flaw in ransomware campaigns. The issue spans multiple Check Point product lines: CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2024-05-30 with ransomware use listed, and EPSS assigns a 100% probability of exploitation within 30 days, though no public proof-of-concept is known.

Do: Apply the hotfix Check Point distributes per its advisory (SK170863) to all internet-facing gateways running IPSec VPN, Remote Access VPN, or Mobile Access; this is also the CISA KEV required action. Where the hotfix cannot be applied immediately, restrict or disable the Remote Access VPN and Mobile Access software blades as an interim mitigation. Review gateway and VPN logs for signs of exploitation and prioritize remediation given confirmed ransomware use.