Linux Kernel netfilter (nf_tables) Use-After-Free Local Privilege Escalation Vulnerability Advisory (CVE-2024-1086)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-1086) is a Use-After-Free (UAF) flaw in the nf_tables component of the Linux kernel's netfilter subsystem. The root cause lies in the nft_verdict_init() function, which incorrectly allows positive values as drop errors within the hook verdict. Consequently, the nf_hook_slow() function misinterprets an NF_DROP verdict accompanied by a specific drop error as if it were NF_ACCEPT. This logical discrepancy leads to a double-free condition on the same packet buffer (sk_buff), resulting in a Use-After-Free state.

2. Exploitation Mechanics & Attack Scenario

An attacker with local unprivileged access leverages unprivileged user namespaces to gain administrative capabilities over nf_tables. By sending crafted Netlink messages, the attacker triggers nft_verdict_init() with a malicious drop error value. When nf_hook_slow() processes this verdict, the underlying sk_buff is freed twice. The attacker then performs heap grooming (Heap Feng Shui) to reclaim the freed memory block with controlled payload data, overwriting kernel function pointers to redirect execution flow and achieve local privilege escalation (LPE) to root.

3. Infrastructure & Business Impact

This vulnerability is highly critical and is actively exploited in the wild, as evidenced by its inclusion in the CISA KEV catalog and a high EPSS score. In multi-tenant environments, container hosts, and cloud infrastructures, this flaw allows malicious local actors or compromised containerized applications to escape isolation boundaries and compromise the host operating system, threatening the confidentiality, integrity, and availability of the entire infrastructure.