NetSight
IP …
high7.8Known exploited

CVE-2024-1086

Linux Kernel Use-After-Free Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-05-30. Federal due date: 2024-06-20.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Affected products

VendorProductAffected versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH410s Firmware
All versions
NetappH410c Firmware
All versions
NetappBootstrap Os
All versions
LinuxLinux Kernel
from 3.15 before 5.15.149
from 6.1 before 6.1.76
from 6.2 before 6.6.15
from 6.7 before 6.7.3
Version 6.8
FedoraprojectFedora
Version 39
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux For Ibm Z Systems
Version 7.0_s390x
RedhatEnterprise Linux For Power Big Endian
Version 7.0_ppc64
RedhatEnterprise Linux For Power Little Endian
Version 7.0_ppc64le

Weakness classification

CWE-416

References