CVE-2024-0607

What it actually does

The nft_byteorder_eval() function in the Linux kernel Netfilter subsystem performs an 8-byte write into each element of a u32 dst array during loop iteration, resulting in out-of-bounds memory corruption within the kernel's nftables byte-order handling path.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory corruption that leads to denial of service or loss of network filtering functionality, potentially disrupting services that rely on netfilter rules and increasing operational risk on servers and endpoints.

How an attack unfolds

A local attacker with the ability to load or interact with nftables rules invokes nft_byteorder_eval() through crafted nftables expressions; the loop then repeatedly writes 8 bytes into 4-byte u32 slots, corrupting adjacent kernel memory and allowing denial-of-service or breakage of NetFilter processing.

How to fix it

Upgrade the Linux kernel to a version containing commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 or later; rebuild and reboot with the patched kernel, then verify nftables functionality remains intact.

How to confirm the fix worked

Confirm the running kernel contains commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63, test nftables byteorder rules to ensure no crashes occur, and review kernel logs for absence of memory corruption warnings in the netfilter path.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Load or modify nftables rules that exercise the byteorder expression
3. Trigger nft_byteorder_eval() via the crafted ruleset
4. Observe kernel memory corruption leading to crash or netfilter malfunction

How to detect it

Review kernel logs for oops/panic messages referencing nft_byteorder_eval or netfilter memory faults; inspect nftables rule loading events and any subsequent netfilter functionality failures.

What your security team should do

• Prioritize kernel updates on all systems that use nftables or netfilter
• Restrict local user privileges where possible to reduce attack surface
• Monitor for kernel oops or panics related to netfilter after patching