CVE-2024-39503

What it actually does

Race condition between namespace cleanup and garbage collection in ipset list:set type leads to use-after-free when sets are destroyed while RCU-protected GC callbacks still reference them.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, resulting in crashes, denial of service, or potential privilege escalation; widespread impact on servers, containers, and appliances using ipset.

How an attack unfolds

An attacker with local access creates list:set ipsets and triggers concurrent namespace teardown and GC work; the missing synchronization allows the GC to dereference freed set data after the sets are destroyed during cleanup.

How to fix it

Update the Linux kernel to a version containing commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and reboot with the patched kernel; ensure any dependent netfilter/ipset userspace tools are compatible.

How to confirm the fix worked

Verify the running kernel contains commit e8f897f4afef0031fe618a8e94127a0934896aba via git log or uname; confirm ipset list operations no longer trigger use-after-free under concurrent namespace destruction; run the ipset userspace test suite with RCU locking enabled.

Typical attack path

1. Obtain local code execution on a vulnerable Linux host
2. Create list:set ipsets that register GC callbacks
3. Trigger namespace exit or ipset flush/destroy concurrently with GC scheduling
4. Exploit resulting use-after-free for memory corruption or information leak

How to detect it

Review kernel logs for use-after-free warnings or oops associated with ipset list:set and RCU callbacks during namespace exit; inspect auditd or syscall traces for unusual ipset create/destroy sequences followed by crashes; correlate with container or network namespace teardown events.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux systems within the next 30 days
• Audit workloads that rely on ipset list:set types and namespace isolation
• Enable kernel hardening features such as CONFIG_SLAB_FREELIST_RANDOM and page allocator poisoning
• Monitor for future related netfilter patches and schedule staged rollouts