CVE-2024-42070

What it actually does

The flaw permits leakage of kernel pointers to chain objects via nftables data registers because register store validation for NFT_DATA_VALUE is conditional rather than unconditional, allowing uninitialized or incorrect data types to expose internal pointers.

Why it matters to the business

Local users on affected Linux systems may obtain kernel address information that weakens memory protection mechanisms, increasing the difficulty and cost of defending against subsequent local attacks; remediation urgency remains moderate given low exploit maturity and absence from known exploited vulnerability lists.

How an attack unfolds

A local attacker interacts with nftables to create sets or rules that store NFT_DATA_VALUE entries into registers; the missing unconditional validation allows a pointer to a chain object to be written into a register that is later readable by user space, disclosing kernel addresses that can be used to bypass KASLR in follow-on exploits.

How to fix it

Update the Linux kernel to include commit d8ec26d7f8287f5788a494f56e8814210f0e64be or later; rebuild and deploy the fixed kernel across all affected distributions and custom builds that incorporate nftables.

How to confirm the fix worked

Confirm the running kernel source tree contains commit d8ec26d7f8287f5788a494f56e8814210f0e64be, then exercise nftables register store paths while verifying that no chain pointers are observable in user-space registers.

Typical attack path

1. Obtain local user access on a Linux system using nftables
2. Load or modify nftables rules and sets to trigger register stores
3. Craft operations that store NFT_DATA_VALUE without full type validation
4. Read leaked chain pointers from accessible registers
5. Leverage disclosed addresses to prepare further kernel exploits

How to detect it

Review kernel logs and audit trails for nftables rule or set creation events that involve register stores; correlate with any subsequent attempts to read or act on unexpected kernel addresses.

What your security team should do

• Apply the kernel commit d8ec26d7f8287f5788a494f56e8814210f0e64be on all systems using nftables
• Restrict unprivileged local access to nftables where possible until patches are deployed
• Include nftables-related kernel logs in routine security monitoring