CVE-2024-1086

2024-01-3100:00:00

ubuntu.com

linux kernel

netfilter nf_tables

local privilege escalation

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

A use-after-free vulnerability in the Linux kernel’s netfilter: nf_tables
component can be exploited to achieve local privilege escalation. The
nft_verdict_init() function allows positive values as drop error within the
hook verdict, and hence the nf_hook_slow() function can cause a double free
vulnerability when NF_DROP is issued with a drop error which resembles
NF_ACCEPT. We recommend upgrading past commit
f342de4e2f33e0e39165d8639387aa6c19dff660.

Bugs

Notes

Author	Note
	Priority reason: By passing a positive value such as NF_ACCEPT, a local attacker can elevate privileges due to a use-after-free error.
rodrigo-zaiden	from Google kCTF. the fix commit reverts the break commit.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-223.235) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu20.04noarchlinux< 5.4.0-174.193UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-101.111UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-26.26UNKNOWN
ubuntu24.04noarchlinux< anyUNKNOWN
ubuntu16.04noarchlinux< 4.4.0-252.286) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1166.179) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1121.131UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1056.61UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1016.16UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-223.235) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-174.193	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-101.111	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-26.26	UNKNOWN
ubuntu	24.04	noarch	linux	< any	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-252.286) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1166.179) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1121.131	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1056.61	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1016.16	UNKNOWN