{"id":"CVE-2024-0193","title":"Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation","summary":"A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on a…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"Red Hat","product":"kernel","affected":["kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel-rt (all versions)","kernel (all versions)","kernel-rt (all versions)","openshift-logging/cluster-logging-operator-bundle (all versions)","openshift-logging/cluster-logging-rhel9-operator (all versions)","openshift-logging/elasticsearch6-rhel9 (all versions)","openshift-logging/elasticsearch-operator-bundle (all versions)","openshift-logging/elasticsearch-proxy-rhel9 (all versions)","openshift-logging/elasticsearch-rhel9-operator (all versions)","openshift-logging/eventrouter-rhel9 (all versions)","openshift-logging/fluentd-rhel9 (all versions)","openshift-logging/log-file-metric-exporter-rhel9 (all versions)","openshift-logging/logging-curator5-rhel9 (all versions)","openshift-logging/logging-loki-rhel9 (all versions)","openshift-logging/logging-view-plugin-rhel9 (all versions)","openshift-logging/loki-operator-bundle (all versions)","openshift-logging/loki-rhel9-operator (all versions)","openshift-logging/lokistack-gateway-rhel9 (all versions)","openshift-logging/opa-openshift-rhel9 (all versions)","openshift-logging/vector-rhel9 (all versions)","kernel","kernel","kernel-rt","kernel","kernel-rt","kernel-rt (all versions)"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2024-07-02T13:17:27.203202Z"},"exploitAvailable":true,"published":"2024-01-02","updated":"2026-11-04","sourceUpdated":"2026-11-04T21:07:31.422Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-0193","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:1018","label":"RHSA-2024:1018"},{"url":"https://access.redhat.com/errata/RHSA-2024:1019","label":"RHSA-2024:1019"},{"url":"https://access.redhat.com/errata/RHSA-2024:1248","label":"RHSA-2024:1248"},{"url":"https://access.redhat.com/errata/RHSA-2024:2094","label":"RHSA-2024:2094"},{"url":"https://access.redhat.com/errata/RHSA-2024:4412","label":"RHSA-2024:4412"},{"url":"https://access.redhat.com/errata/RHSA-2024:4415","label":"RHSA-2024:4415"},{"url":"https://access.redhat.com/security/cve/CVE-2024-0193"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255653","label":"RHBZ#2255653"}],"tags":["cve.org","exploit-available"],"epss":0.00836,"epssPercentile":0.57851,"ingestedAt":"2026-11-05T21:36:00.594Z","slug":"CVE-2024-0193","body":"## Overview\n\nA use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.\n\n## Affected\n\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `openshift-logging/cluster-logging-operator-bundle (all versions)`\n- `openshift-logging/cluster-logging-rhel9-operator (all versions)`\n- `openshift-logging/elasticsearch6-rhel9 (all versions)`\n- `openshift-logging/elasticsearch-operator-bundle (all versions)`\n- `openshift-logging/elasticsearch-proxy-rhel9 (all versions)`\n- `openshift-logging/elasticsearch-rhel9-operator (all versions)`\n- `openshift-logging/eventrouter-rhel9 (all versions)`\n- `openshift-logging/fluentd-rhel9 (all versions)`\n- `openshift-logging/log-file-metric-exporter-rhel9 (all versions)`\n- `openshift-logging/logging-curator5-rhel9 (all versions)`\n- `openshift-logging/logging-loki-rhel9 (all versions)`\n- `openshift-logging/logging-view-plugin-rhel9 (all versions)`\n- `openshift-logging/loki-operator-bundle (all versions)`\n- `openshift-logging/loki-rhel9-operator (all versions)`\n- `openshift-logging/lokistack-gateway-rhel9 (all versions)`\n- `openshift-logging/opa-openshift-rhel9 (all versions)`\n- `openshift-logging/vector-rhel9 (all versions)`\n- `kernel`\n- `kernel`\n- `kernel-rt`\n- `kernel`\n- `kernel-rt`\n- `kernel-rt (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nIn order to trigger the issue, it requires the ability to create user/net namespaces.\n\nOn non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:\n\n# echo \"user.max_user_namespaces=0\" > /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\n\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}