CVE-2024-0193High· 7.8▾ MidnightPoC availableA use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on a…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
kernel (all versions)kernel (all versions)kernel (all versions)kernel (all versions)kernel-rt (all versions)kernel (all versions)kernel-rt (all versions)openshift-logging/cluster-logging-operator-bundle (all versions)openshift-logging/cluster-logging-rhel9-operator (all versions)openshift-logging/elasticsearch6-rhel9 (all versions)openshift-logging/elasticsearch-operator-bundle (all versions)openshift-logging/elasticsearch-proxy-rhel9 (all versions)openshift-logging/elasticsearch-rhel9-operator (all versions)openshift-logging/eventrouter-rhel9 (all versions)openshift-logging/fluentd-rhel9 (all versions)openshift-logging/log-file-metric-exporter-rhel9 (all versions)openshift-logging/logging-curator5-rhel9 (all versions)openshift-logging/logging-loki-rhel9 (all versions)openshift-logging/logging-view-plugin-rhel9 (all versions)openshift-logging/loki-operator-bundle (all versions)openshift-logging/loki-rhel9-operator (all versions)openshift-logging/lokistack-gateway-rhel9 (all versions)openshift-logging/opa-openshift-rhel9 (all versions)openshift-logging/vector-rhel9 (all versions)kernelkernelkernel-rtkernelkernel-rtkernel-rt (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
In order to trigger the issue, it requires the ability to create user/net namespaces.
On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:
On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-0582High· 7.8Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
CVE-2024-0562High· 7.8Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c
CVE-2023-3397High· 7.0Kernel: slab-use-after-free write in txend due to race condition
CVE-2023-6270High· 7.0Kernel: aoe: improper reference count leads to use-after-free vulnerability
CVE-2023-1118High· 7.8A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device
CVE-2021-4204NoneAn out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation