CVE-2024-1086

Linux Kernel Use-After-Free

7.8 HIGHActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 28.1%

Published31 Jan 2024
Added to CISA KEV30 May 2024
Remediation due20 Jun 2024

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Debian Linux10.0

Fedoraproject Fedora39

Linux Kernel≥ 3.15 < 5.15.149 · ≥ 6.1 < 6.1.76 · ≥ 6.2 < 6.6.15 · ≥ 6.7 < 6.7.3

Netapp 500f Firmwareall versions

Netapp A250 Firmwareall versions

Netapp Bootstrap OSall versions

Netapp C250 Firmwareall versions

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H700s Firmwareall versions

Redhat Enterprise Linux Desktop7.0

Redhat Enterprise Linux For Ibm Z Systems7.0_s390x

Redhat Enterprise Linux For Power Big Endian7.0_ppc64

Redhat Enterprise Linux For Power Little Endian7.0_ppc64le

Redhat Enterprise Linux Server7.0

Redhat Enterprise Linux Workstation7.0

Remediation

Fixed in

Linux Kernel≥ 5.15.149

Patch & vendor advisories

References

https://github.com/Notselwyn/CVE-2024-1086ExploitThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660Patch
https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlMailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/Mailing List
https://news.ycombinator.com/item?id=39828424Issue Tracking
https://pwning.tech/nftables/ExploitTechnical DescriptionThird Party Advisory
https://security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086US Government Resource

and 5 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-1086 being actively exploited?

Yes. CVE-2024-1086 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 30 May 2024. It has been used in ransomware campaigns.

How severe is CVE-2024-1086?

CVE-2024-1086 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 28.1% probability of exploitation.

Which products are affected by CVE-2024-1086?

Affected products include Debian Linux, Fedoraproject Fedora, Linux Kernel, Netapp 500f Firmware, Netapp A250 Firmware, and 13 more.

How do I fix CVE-2024-1086?

Upgrade affected software to a fixed version, for example Linux Kernel 5.15.149 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-1086 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.