CVE-2024-0193

What it actually does

Use-after-free in Linux kernel netfilter pipapo sets where catchall element garbage collection during set removal causes double deactivation of NFT_CHAIN or NFT_OBJECT, enabling local memory corruption.

Why it matters to the business

Local privilege escalation to root on affected Linux systems including numerous Red Hat Enterprise Linux variants, risking full host compromise, data theft, or persistence by any user granted CAP_NET_ADMIN.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates and removes specially crafted pipapo sets to trigger catchall element garbage collection, forcing double deactivation of an NFT object and converting the resulting use-after-free into kernel code execution for privilege escalation.

How to fix it

Apply the latest Linux kernel updates from the distribution vendor that resolve the double-deactivation use-after-free in the netfilter pipapo implementation; reboot into the patched kernel.

How to confirm the fix worked

Confirm the running kernel version contains the netfilter fix, review changelog entries for the pipapo set removal path, and test that CAP_NET_ADMIN users can no longer trigger the described double-deactivation condition.

Typical attack path

1. Acquire CAP_NET_ADMIN capability on the target host
2. Craft and install netfilter pipapo sets containing catchall elements
3. Trigger set removal and garbage collection to induce double deactivation
4. Leverage use-after-free on NFT_CHAIN or NFT_OBJECT for arbitrary kernel write
5. Escalate privileges to root and establish persistence

How to detect it

Inspect kernel logs and dmesg for use-after-free or double-free warnings involving nft_chain or nft_object; review audit logs for unusual nft set creation and deletion by non-root users; correlate with processes holding CAP_NET_ADMIN.

What your security team should do

• Immediately update Linux kernels on all affected Red Hat and upstream systems
• Restrict the CAP_NET_ADMIN capability to the minimum set of trusted processes and users
• Audit netfilter configuration changes via auditd or eBPF
• Monitor kernel logs for use-after-free warnings or oops related to nft objects