Linux Netfilter Use-After-Free Enables Local Privilege Escalation
Attack Tradecraft · 2 sources · Updated 2mo ago · First seen Jul 8, 2024
CVE-2024-27397 is a use-after-free flaw in the Linux kernel's netfilter/nf_tables subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1.
The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected kernel and kernel-rt packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
