CVE-2024-1086
Linux Kernel Use-After-Free Vulnerability
Description
CVE-2024-1086 is a high-severity use-after-free vulnerability in the Linux kernel's netfilter nf_tables component that can be exploited to achieve local privilege escalation. With a CVSS v3.1 base score of 7.8, the flaw exists in the nft_verdict_init() function, which improperly allows positive values as drop errors within hook verdicts, enabling a double-free condition when NF_DROP is issued with a drop error resembling NF_ACCEPT. The vulnerability affects a broad range of Linux kernel versions from 3.15 through 6.7.3, impacting major distributions including Red Hat, Debian, and Fedora. CISA has added CVE-2024-1086 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 20, 2024, with a confirmed ransomware association. Its EPSS score of 85.19% at the 99.3rd percentile confirms widespread active exploitation across the threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | h410s firmware | - |
| netapp | h410c firmware | - |
| netapp | bootstrap os | - |
| linux | linux kernel | >= 3.15, < 5.15.149; >= 6.1, < 6.1.76; >= 6.2, < 6.6.15; >= 6.7, < 6.7.3; 6.8 |
| fedoraproject | fedora | 39 |
| redhat | enterprise linux desktop | 7.0 |
| redhat | enterprise linux for ibm z systems | 7.0_s390x |
| redhat | enterprise linux for power big endian | 7.0_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux server | 7.0 |
| redhat | enterprise linux workstation | 7.0 |
| debian | debian linux | 10.0 |
| netapp | a250 firmware | - |
| netapp | 500f firmware | - |
| netapp | c250 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2024/04/10/22(Mailing List, Patch)
- http://www.openwall.com/lists/oss-security/2024/04/10/23(Mailing List, Patch)
- http://www.openwall.com/lists/oss-security/2024/04/14/1(Exploit, Mailing List)
- http://www.openwall.com/lists/oss-security/2024/04/15/2(Mailing List)
- http://www.openwall.com/lists/oss-security/2024/04/17/5(Exploit, Mailing List)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660(Patch)
- https://github.com/Notselwyn/CVE-2024-1086(Exploit, Third Party Advisory)
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660(Patch)
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/(Mailing List)
- https://news.ycombinator.com/item?id=39828424(Issue Tracking)
- https://pwning.tech/nftables/(Exploit, Technical Description, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20240614-0009/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086(US Government Resource)
Weakness Type
Use After Free in Netfilter nf_tables
CVE-2024-1086 is a use-after-free vulnerability triggered by a logic error in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. The nft_verdict_init() function incorrectly permits positive values as drop error codes within the hook verdict structure. When the NF_DROP verdict is processed with an error value that the kernel interprets as NF_ACCEPT, the nf_hook_slow() function enters an incorrect code path that leads to a double-free condition. A double-free is a specific type of use-after-free where memory is freed twice, corrupting the heap allocator's metadata and creating exploitable conditions for arbitrary memory writes. In the context of the Linux kernel, this is particularly dangerous because it provides a reliable primitive for achieving root-level code execution from an unprivileged user context. Learn more about use-after-free vulnerabilities at CWE-416.
Impact Analysis
The impact of CVE-2024-1086 is catastrophic for local privilege escalation, with the CVSS vector reflecting complete compromise of all three security dimensions from a local attack surface. Confidentiality is fully compromised because successful exploitation escalates a low-privileged user to root, granting unrestricted access to all data on the system, including other users' files, cryptographic keys, passwords in /etc/shadow, and the contents of all running processes' memory.
Integrity faces maximum impact since root-level access allows the attacker to modify any file on the system, install persistent backdoors, tamper with system binaries, alter logging and auditing mechanisms, and modify kernel modules. The ability to write arbitrary kernel memory during exploitation means the attacker can disable security controls such as SELinux, AppArmor, and seccomp before the system even registers the compromise.
Availability is completely at risk as a root-level attacker can shut down services, destroy data, corrupt the filesystem, or render the system unbootable. The confirmed ransomware association makes this particularly concerning, as attackers use this vulnerability to escalate privileges on compromised Linux servers before deploying ransomware across the environment. The EPSS score of 85.19% at the 99.3rd percentile combined with multiple public exploits and detailed technical writeups make CVE-2024-1086 one of the most dangerous Linux kernel vulnerabilities of 2024.
Exploit Maturity
CVE-2024-1086 has reached maximum exploit maturity with a fully weaponized public exploit, confirmed active exploitation, and a direct ransomware association. CISA has included it in the Known Exploited Vulnerabilities catalog with an urgent remediation deadline of June 20, 2024. The EPSS score of 85.19% at the 99.3rd percentile reflects extremely high exploitation probability.
A complete, reliable exploit has been published on GitHub by the researcher Notselwyn, including a detailed technical writeup at pwning.tech that explains the exploitation technique in depth. The exploit achieves reliable local privilege escalation to root on a wide range of affected kernel versions. Additional exploit details and discussions have been shared on the oss-security mailing list, with multiple independent researchers confirming the exploit's reliability.
The confirmed ransomware classification by CISA is particularly significant. Ransomware operators are actively using CVE-2024-1086 as a privilege escalation step after gaining initial access to Linux servers, enabling them to deploy ransomware with root privileges for maximum encryption coverage. The kernel patch is available at kernel.org.
Remediation
-
Update the Linux kernel to a patched version immediately. Apply the fix from the upstream kernel commit f342de4e2f33e0e39165d8639387aa6c19dff660. Patched versions include kernel 5.15.149+, 6.1.76+, 6.6.15+, and 6.7.3+. Use your distribution's package manager to install the latest available kernel update.
-
Apply distribution-specific security updates. Red Hat, Debian, Fedora, and other major distributions have released patched kernel packages. For Red Hat Enterprise Linux 7, apply the relevant security advisory. For Debian 10 (Buster), consult the debian-lts-announce advisories. Prioritize patching production servers and systems accessible to multiple users.
-
Restrict access to nf_tables functionality as an interim mitigation. If immediate patching is not possible, disable unprivileged user namespaces to prevent non-root users from creating nf_tables rules. On systems that do not require nf_tables, blacklist the nf_tables kernel module. Note that this is a temporary workaround, not a substitute for patching.
-
Monitor for privilege escalation indicators. Deploy host-based intrusion detection to identify suspicious privilege escalation patterns, unexpected root process creation from non-root users, and known exploitation signatures. Review system logs for anomalous netfilter activity and unexpected kernel module operations.
-
Assume compromise for unpatched, multi-user systems. Any Linux system running a vulnerable kernel version that was accessible to untrusted users should be audited for compromise. Check for unauthorized SSH keys, modified system binaries, unexpected cron jobs, and rootkit indicators. Given the ransomware association, verify backup integrity before patching to ensure a clean recovery path is available.
Technical Details
CVE-2024-1086 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables component with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a high base score of 7.8. The local attack vector (AV:L) means the attacker must have local access to the target system. The low attack complexity (AC:L) reflects the reliability of the exploitation technique, and the low privilege requirement (PR:L) means any unprivileged user can trigger the vulnerability.
The root cause lies in the nft_verdict_init() function within the netfilter nf_tables subsystem. This function processes verdict structures that determine how network packets are handled by firewall rules. The function accepts positive values as drop error codes within hook verdicts, which creates a critical logic error. When a firewall rule issues an NF_DROP verdict with a positive error value, the nf_hook_slow() function misinterprets the verdict due to the positive error code resembling an NF_ACCEPT result. This causes the function to process the packet as accepted rather than dropped, leading to a code path where the packet's network buffer (skb) is freed twice — once during the drop handling and again during the accept handling.
This double-free corrupts the kernel's SLUB allocator metadata, providing the attacker with a powerful heap corruption primitive. The published exploit leverages this double-free to achieve arbitrary read and write access to kernel memory through careful heap manipulation. By spraying the kernel heap with controlled objects and exploiting the double-free to overlap allocations, the attacker can overwrite kernel data structures to escalate privileges from an unprivileged user to root. The scope remains unchanged (S:U) but the full compromise of confidentiality (C:H), integrity (I:H), and availability (A:H) at the kernel level means complete system takeover. Affected kernel versions span from 3.15 through 6.7.3, with specific patched versions at 5.15.149, 6.1.76, 6.6.15, and 6.7.3.
Frequently Asked Questions
What is CVE-2024-1086?
CVE-2024-1086 is a high-severity use-after-free vulnerability in the Linux kernel's netfilter nf_tables component that allows any local unprivileged user to escalate their privileges to root. It has a CVSS v3.1 score of 7.8 and is actively exploited in the wild with a confirmed ransomware association.
Is CVE-2024-1086 being used in ransomware attacks?
Yes. CISA has confirmed a direct ransomware association for CVE-2024-1086. Ransomware operators use this vulnerability to escalate privileges to root on compromised Linux servers, enabling them to deploy encryption payloads with maximum access to files and services.
Which Linux kernel versions are affected?
CVE-2024-1086 affects Linux kernel versions from 3.15 through 6.7.3. Patched versions include 5.15.149+, 6.1.76+, 6.6.15+, and 6.7.3+. Major distributions including Red Hat Enterprise Linux 7, Debian 10, and Fedora 39 are affected and have released security updates.
Is there a public exploit available for CVE-2024-1086?
Yes. A fully weaponized, reliable exploit has been publicly released on GitHub and demonstrated to achieve root privilege escalation on a wide range of affected kernel versions. The availability of this exploit significantly increases the risk for any unpatched system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.