CVE-2024-1086 (Flipping Pages)
CVSS v3.1
7.8 (High)
EPSS
0.29 % (70th)
Affected Products
15
Advisories
86
NVD Status
Analyzed
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- CVE Status
- PUBLISHED
- NVD Status
- Analyzed
- CNA
- Google Inc.
- Published Date
-
2024-01-31 13:15:10
(7 months ago) - Updated Date
-
2024-08-14 19:41:08
(3 weeks ago)
Linux Kernel Use-After-Free Vulnerability (CISA - Known Exploited Vulnerabilities Catalog)
- Description
- Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
- Required Action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known to be Used in Ransomware Campaigns
- Unknown
- Notes
- This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
- Vendor
- Linux
- Product
- Kernel
- In CISA Catalog from
-
2024-05-30
(3 months ago) - Due Date
-
2024-06-20
(2 months ago)
Affected Products
Loading...
Loading...
Configuration #1
|
Configuration #2
|
Configuration #3
|
Configuration #4
|
Configuration #5
AND |
|
---|
Configuration #6
AND |
|
---|
Configuration #7
AND |
|
---|
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...