2262126 – (CVE-2024-1086) CVE-2024-1086 kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function

Bug 2262126 (CVE-2024-1086) - CVE-2024-1086 kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function [NEEDINFO]

Summary: CVE-2024-1086 kernel: nf_tables: use-after-free vulnerability in the nft_verd...

Keywords:
Status:	NEW
Alias:	CVE-2024-1086
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Duplicates (1):	CVE-2024-26609 (view as bug list)
Depends On:	2262128
Blocks:	2269240 2262125
TreeView+	depends on / blocked

Reported:	2024-01-31 18:06 UTC by Patrick Del Bello
Modified:	2025-09-06 08:30 UTC (History)
CC List:	61 users (show)
Fixed In Version:	kernel 6.8-rc2
Clone Of:
Environment:
Last Closed:
Embargoed:
Flags:	kacij88804: needinfo? (acaringi)

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2024:1338	None	None	None	2024-03-14 15:52:24 UTC
Red Hat Product Errata	RHBA-2024:1350	None	None	None	2024-03-18 08:41:27 UTC
Red Hat Product Errata	RHBA-2024:1699	None	None	None	2024-04-08 14:54:20 UTC
Red Hat Product Errata	RHBA-2024:2634	None	None	None	2024-05-01 01:22:27 UTC
Red Hat Product Errata	RHBA-2024:2650	None	None	None	2024-05-02 00:15:14 UTC
Red Hat Product Errata	RHBA-2024:2686	None	None	None	2024-05-02 22:50:21 UTC
Red Hat Product Errata	RHBA-2024:3866	None	None	None	2024-06-12 15:30:46 UTC
Red Hat Product Errata	RHSA-2024:0930	None	None	None	2024-02-21 00:27:49 UTC
Red Hat Product Errata	RHSA-2024:1018	None	None	None	2024-02-28 12:41:40 UTC
Red Hat Product Errata	RHSA-2024:1019	None	None	None	2024-02-28 12:34:16 UTC
Red Hat Product Errata	RHSA-2024:1249	None	None	None	2024-03-12 00:47:38 UTC
Red Hat Product Errata	RHSA-2024:1332	None	None	None	2024-03-14 14:51:24 UTC
Red Hat Product Errata	RHSA-2024:1404	None	None	None	2024-03-19 17:28:07 UTC
Red Hat Product Errata	RHSA-2024:1607	None	None	None	2024-04-02 15:55:52 UTC
Red Hat Product Errata	RHSA-2024:1614	None	None	None	2024-04-02 17:22:05 UTC
Red Hat Product Errata	RHSA-2024:2394	None	None	None	2024-04-30 10:15:27 UTC
Red Hat Product Errata	RHSA-2024:2697	None	None	None	2024-05-06 01:25:28 UTC
Red Hat Product Errata	RHSA-2024:3318	None	None	None	2024-05-23 07:38:11 UTC
Red Hat Product Errata	RHSA-2024:3319	None	None	None	2024-05-23 07:37:35 UTC
Red Hat Product Errata	RHSA-2024:3414	None	None	None	2024-05-28 14:05:15 UTC
Red Hat Product Errata	RHSA-2024:3421	None	None	None	2024-05-28 14:07:11 UTC
Red Hat Product Errata	RHSA-2024:3427	None	None	None	2024-05-28 13:20:11 UTC
Red Hat Product Errata	RHSA-2024:3528	None	None	None	2024-05-31 15:47:07 UTC
Red Hat Product Errata	RHSA-2024:3529	None	None	None	2024-05-31 15:51:57 UTC
Red Hat Product Errata	RHSA-2024:3530	None	None	None	2024-05-31 15:44:57 UTC
Red Hat Product Errata	RHSA-2024:3805	None	None	None	2024-06-11 15:43:02 UTC
Red Hat Product Errata	RHSA-2024:4073	None	None	None	2024-06-25 00:26:42 UTC
Red Hat Product Errata	RHSA-2024:4074	None	None	None	2024-06-25 00:18:43 UTC
Red Hat Product Errata	RHSA-2024:4075	None	None	None	2024-06-25 00:17:54 UTC

Description Patrick Del Bello 2024-01-31 18:06:13 UTC

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660

Comment 1 Patrick Del Bello 2024-01-31 18:06:49 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2262128]

Comment 9 errata-xmlrpc 2024-02-21 00:27:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0930 https://access.redhat.com/errata/RHSA-2024:0930

Comment 11 errata-xmlrpc 2024-02-28 12:34:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:1019 https://access.redhat.com/errata/RHSA-2024:1019

Comment 12 errata-xmlrpc 2024-02-28 12:41:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:1018 https://access.redhat.com/errata/RHSA-2024:1018

Comment 13 errata-xmlrpc 2024-03-12 00:47:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:1249 https://access.redhat.com/errata/RHSA-2024:1249

Comment 17 errata-xmlrpc 2024-03-14 14:51:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:1332 https://access.redhat.com/errata/RHSA-2024:1332

Comment 19 errata-xmlrpc 2024-03-19 17:28:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404

Comment 21 Alex 2024-04-02 10:51:02 UTC

*** Bug 2269217 has been marked as a duplicate of this bug. ***

Comment 22 errata-xmlrpc 2024-04-02 15:55:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1607 https://access.redhat.com/errata/RHSA-2024:1607

Comment 23 errata-xmlrpc 2024-04-02 17:22:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1614 https://access.redhat.com/errata/RHSA-2024:1614

Comment 26 Alexander Peslyak 2024-04-07 00:16:18 UTC

Hi. https://access.redhat.com/security/cve/CVE-2024-1086 does not mention RHEL 9 latest at all (it only mentions other major versions and 9.2 EUS), whereas 9.3 is in fact affected - the published exploit just works all the way to a root shell. I wonder if this maybe slipped through the cracks, and actually delays fixing the issue for 9.3/9.4? And even if not, it's something to fix on that access page. Thanks!

Comment 29 Alexander Peslyak 2024-04-08 17:54:37 UTC

> https://access.redhat.com/security/cve/CVE-2024-1086 does not mention RHEL 9 latest at all

Oops, I was wrong, sorry! It does say RHEL 9 is Affected on the second page of results (the first page is "1-10 of 12"). I find this UI non-intuitive, and keep forgetting more pages of results may exist. Anyway, good to know the issue is known and acknowledged.

Comment 36 errata-xmlrpc 2024-04-30 10:15:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394

Comment 39 errata-xmlrpc 2024-05-06 01:25:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:2697 https://access.redhat.com/errata/RHSA-2024:2697

Comment 40 errata-xmlrpc 2024-05-23 07:37:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:3319 https://access.redhat.com/errata/RHSA-2024:3319

Comment 41 errata-xmlrpc 2024-05-23 07:38:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support

Via RHSA-2024:3318 https://access.redhat.com/errata/RHSA-2024:3318

Comment 42 errata-xmlrpc 2024-05-28 13:20:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:3427 https://access.redhat.com/errata/RHSA-2024:3427

Comment 43 errata-xmlrpc 2024-05-28 14:05:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:3414 https://access.redhat.com/errata/RHSA-2024:3414

Comment 44 errata-xmlrpc 2024-05-28 14:07:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:3421 https://access.redhat.com/errata/RHSA-2024:3421

Comment 49 errata-xmlrpc 2024-05-31 15:44:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:3530 https://access.redhat.com/errata/RHSA-2024:3530

Comment 50 errata-xmlrpc 2024-05-31 15:47:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:3528 https://access.redhat.com/errata/RHSA-2024:3528

Comment 51 errata-xmlrpc 2024-05-31 15:51:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:3529 https://access.redhat.com/errata/RHSA-2024:3529

Comment 52 errata-xmlrpc 2024-06-11 15:42:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:3805 https://access.redhat.com/errata/RHSA-2024:3805

Comment 53 errata-xmlrpc 2024-06-25 00:17:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

Via RHSA-2024:4075 https://access.redhat.com/errata/RHSA-2024:4075

Comment 54 errata-xmlrpc 2024-06-25 00:18:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4074 https://access.redhat.com/errata/RHSA-2024:4074

Comment 55 errata-xmlrpc 2024-06-25 00:26:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:4073 https://access.redhat.com/errata/RHSA-2024:4073

Comment 56 lyly 2024-10-23 03:40:41 UTC Comment hidden (spam)

(In reply to errata-xmlrpc from comment #55)
> This issue has been addressed in the following products:
> 
>   Red Hat Enterprise Linux 7
> https://pokerogue.io
> Via RHSA-2024:4073 https://access.redhat.com/errata/RHSA-2024:4073

Great!

Comment 57 traffic rally 2025-05-06 03:53:14 UTC Comment hidden (spam)

This comment was flagged as spam, view the edit history to see the original text if required.

Comment 58 tixipi5037@ihnpo.com 2025-06-23 10:22:45 UTC Comment hidden (spam)

This comment was flagged as spam, view the edit history to see the original text if required.

Comment 59 gta6downloadapk 2025-06-24 05:51:25 UTC Comment hidden (spam)

This comment was flagged as spam, view the edit history to see the original text if required.

Comment 60 cimopi 2025-06-24 05:57:05 UTC Comment hidden (spam)

This comment was flagged as spam, view the edit history to see the original text if required.

Comment 61 iridales 2025-07-02 09:28:51 UTC

From caves and cliffs to lush caves and deep darks, Minecraft’s updates always keep things exciting.https://theminecraft.com.in/

Note You need to log in before you can comment on or make changes to this bug.

acaringi
ajmitchell
allarkin
aquini
bhu
chaekim
chwhite
cye
cyin
dbohanno
debarbos
dfreiber
drow
dvlasenk
esandeen
ezulian
fwestpha
hkrzesin
jarod
jburrell
jdenham
jfaracco
jforbes
jlelli
joe.lawrence
jpoimboe
jshortt
jstancek
jwyatt
kacij88804
kcarcia
kgrant
kyoshida
ldoskova
lgoncalv
lyly.gm19
lzampier
mbenatto
mcascell
mleitner
mmilgram
mstowell
nmurray
prodsec-ir-bot
ptalbert
rogbas
rparrazo
rrobaina
rvrbovsk
scweaver
solar
sukulkar
tglozar
vkumar
wcosta
williams
wmealing
xiaoyali
ycote
ykopkova
zhijwang