CVE-2024-35897

What it actually does

Use-after-free in netfilter nf_tables when a table dormant flag update is combined with basechain deletion, leaving a hook registered after the chain is freed.

Why it matters to the business

Local users can trigger kernel instability or crashes on systems running affected Linux kernels, leading to denial of service and potential system downtime until patched.

How an attack unfolds

An attacker with local access issues nftables commands that combine a table dormant flag change with basechain deletion; the deferred hook unregistration leaves a dangling hook that is used after the chain memory is freed, causing a crash or memory corruption.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.274 or apply the commit e75faf01e22ec7dc671640fa0e0968964fafd2fc; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed releases; test nftables table flag and basechain operations to confirm no crash occurs.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Load or interact with nftables to create a basechain
3. Issue a combined dormant flag update and basechain delete operation
4. Trigger the commit phase to exercise the use-after-free condition

How to detect it

Review kernel logs for nf_tables related oops, panic, or use-after-free warnings around the time of nftables configuration changes; inspect audit logs for sequences of nft table and chain commands.

What your security team should do

• Prioritize kernel updates on all exposed Linux systems within standard patching windows
• Restrict unprivileged local access where possible until patched
• Monitor for kernel oops or panic logs related to nf_tables