# CVE-2024-1086

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

- Page: https://www.vulneraibility.com/cve/CVE-2024-1086
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2024-05-30; CISA due date 2024-06-20; known ransomware use
- EPSS: 28.06% (percentile 98.1)
- Unvetted proof-of-concept code on GitHub: 18 GitHub proofs of concept (first 2024-03-20)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-06-13)
- Weakness: CWE-416
- Published: 2024-01-31

## Affected versions

- Linux Kernel: affected >= 3.15 and < 6.8

A version outside these ranges is not a statement that it is unaffected.

## References

- [patch] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
- [other] https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/
- [other] https://github.com/Notselwyn/CVE-2024-1086
- [other] https://news.ycombinator.com/item?id=39828424
- [other] https://pwning.tech/nftables/
- [other] http://www.openwall.com/lists/oss-security/2024/04/15/2
- [other] http://www.openwall.com/lists/oss-security/2024/04/10/23
- [other] http://www.openwall.com/lists/oss-security/2024/04/10/22
- [other] http://www.openwall.com/lists/oss-security/2024/04/14/1
- [other] http://www.openwall.com/lists/oss-security/2024/04/17/5
- [other] https://security.netapp.com/advisory/ntap-20240614-0009/
- [other] https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
- [other] https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.