CVE-2024-1085

What it actually does

A use-after-free in nf_tables allows repeated freeing of a catch-all set element because nft_setelem_catchall_deactivate checks the wrong generation, enabling a double-free and subsequent kernel memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can gain full root privileges, leading to complete host compromise, data theft, or ransomware deployment.

How an attack unfolds

An attacker with a local account crafts malicious nftables rules that trigger the faulty catch-all deactivation path, performs the double-free to corrupt kernel heap structures, then leverages the corruption to overwrite function pointers or credentials and execute code as root.

How to fix it

Upgrade the Linux kernel to a version containing commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 or later; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7; run regression tests exercising nftables catch-all set operations.

Typical attack path

1. Obtain local shell on target Linux host
2. Load or interact with nftables to trigger nft_setelem_catchall_deactivate
3. Trigger double-free to corrupt kernel memory
4. Escalate to arbitrary kernel code execution
5. Install persistence or exfiltrate data

How to detect it

Review kernel audit logs and nftables rule-change events for repeated or malformed catch-all set operations; look for crashes or oops messages referencing nf_tables around the time of suspected exploitation.

What your security team should do

• Patch kernels immediately on all internet-facing and high-value systems
• Restrict unprivileged users from loading nftables modules until patched
• Monitor for post-patch stability issues during staged rollout