CVE-2024-39504

What it actually does

Missing validation of mandatory netlink attributes for payload and meta expressions inside nft_inner allows NULL pointer dereference when the inner expression is processed from userspace.

Why it matters to the business

Attackers can trigger kernel crashes or denial of service on affected Linux systems that use nftables, potentially disrupting network services and requiring reboots or patches across fleets.

How an attack unfolds

An attacker with the ability to submit nftables rules via netlink crafts an inner expression that omits required meta or payload attributes; the kernel dereferences a NULL pointer during expression evaluation, leading to a crash.

How to fix it

Apply the kernel patch that adds the mandatory attribute validation, corresponding to commit b30669fdea0ca03aa22995e6c99f7e7d9dee89ff in the stable Linux tree; update to a kernel version containing this fix.

How to confirm the fix worked

Verify the presence of the validation checks for mandatory netlink attributes in nft_inner handling by inspecting the kernel source or confirming the applied commit; test rule submission with incomplete inner expressions to ensure no crash occurs.

Typical attack path

1. Obtain capability to issue netlink messages to the nftables subsystem
2. Construct a malformed nft_inner expression lacking mandatory attributes
3. Submit the rule set through the netlink interface
4. Trigger kernel processing of the inner expression to cause NULL dereference

How to detect it

Review kernel logs for NULL pointer dereference oops in nft_inner or netfilter code paths; inspect audit logs for unusual nftables rule submissions from untrusted processes.

What your security team should do

• Prioritize patching Linux kernel installations that expose nftables to untrusted users
• Monitor for kernel oops or panic logs related to nft_inner processing
• Restrict nftables netlink access via capabilities or namespaces where possible until patched