CVE-2024-1085

2024-01-3100:00:00

ubuntu.com

linux kernel

netfilter

nf_tables

local privilege escalation

double free

bug

vulnerability

commit

bugzilla

suse

redhat

priority

filter value

unprivileged

rodrigo-zaiden

google kctf

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.2%

JSON

A use-after-free vulnerability in the Linux kernel’s netfilter: nf_tables
component can be exploited to achieve local privilege escalation. The
nft_setelem_catchall_deactivate() function checks whether the catch-all set
element is active in the current generation instead of the next generation
before freeing it, but only flags it inactive in the next generation,
making it possible to free the element multiple times, leading to a double
free vulnerability. We recommend upgrading past commit
b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

Bugs

Notes

Author	Note
	Priority reason: By passing a certain filter value to nf_tables, an unprivileged local attacker can elevate privileges.
rodrigo-zaiden	from Google kCTF.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchlinux< 5.15.0-101.111UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-26.26UNKNOWN
ubuntu24.04noarchlinux< anyUNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1056.61UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1016.16UNKNOWN
ubuntu24.04noarchlinux-aws< anyUNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1056.61~20.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.5< 6.5.0-1016.16~22.04.1UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1059.67UNKNOWN
ubuntu23.10noarchlinux-azure< 6.5.0-1017.17UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	linux	< 5.15.0-101.111	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-26.26	UNKNOWN
ubuntu	24.04	noarch	linux	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1056.61	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1016.16	UNKNOWN
ubuntu	24.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1056.61~20.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.5	< 6.5.0-1016.16~22.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-azure	< 5.15.0-1059.67	UNKNOWN
ubuntu	23.10	noarch	linux-azure	< 6.5.0-1017.17	UNKNOWN