cve-2024-1086-writeup

CVE-2024-1086 根本原因と悪用 対象カーネル: Linux 6.8 netfilter nftables 新たな視点: nftverdictinit におけるロジック混乱により参照カウントの二重解放が発生し、ヒープスプレーを介した任意メモリ書き込みに悪用可能。 目次 1. 背景 — netfilter / nftables の概要 2. 根本原因分析 — nftverdictinit のロジック混乱 3. 脆弱なカーネルコード — 注釈付きソース抜粋 4. 概念実証 — トリガーおよびエクスプロイトコード 5. 悪用戦略 — ヒープスプレーによる任意書き込み 6. 参考文献...

ROS-20250130-02

Vulnerability of the nftverdictinit function in the net/netfilter/nftablesapi.c module of the operating system kernel Linux is related to the reuse of previously freed memory. Exploitation of the vulnerability could allow an attacker to affect the confidentiality, integrity, and availability of...

A use-after-free vulnerability exists in the Linux kernel's netfilter: nf_tables component

The Linux kernel is vulnerable to memory corruption due to improper error handling within the netfilter functionality. A local attacker could exploit this vulnerability in order to elevate their privileges. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be...

kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function

A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nftverdictinit function, allowing positive values as a drop error within the hook verdict, therefore, the nfhookslow function can cause a double-free vulnerability when NFDROP is issued with a drop error tha...

kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function

A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nftverdictinit function, allowing positive values as a drop error within the hook verdict, therefore, the nfhookslow function can cause a double-free vulnerability when NFDROP is issued with a drop error tha...

The vulnerability of the nft_verdict_init() function in the net/netfilter/nf_tables_api.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information, thereby enhancing their privileges.

The vulnerability of the nftverdictinit function in the net/netfilter/nftablesapi.c module of the Linux operating system is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

CVE-2024-1086

A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nftverdictinit function, allowing positive values as a drop error within the hook verdict, therefore, the nfhookslow function can cause a double-free vulnerability when NFDROP is issued with a drop error tha...

CVE-2024-1086 Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double free...