CVE-2024-44944

What it actually does

Missing call to nf_expect_get_id() in the ctnetlink delete expectation path leaks the LSB of the kernel expectation object address to userspace.

Why it matters to the business

Local users on affected Linux systems can obtain partial kernel address information that may assist further attacks; widespread kernel deployment means broad exposure until patched, though low exploit likelihood reduces immediate operational risk.

How an attack unfolds

An attacker with local access crafts netlink messages targeting the ctnetlink expectation delete path; the missing helper call returns an unmasked address LSB that can be read from userspace, potentially aiding ASLR bypass in chained exploits by espionage or financially motivated actors.

How to fix it

Upgrade Linux kernel to version 4.19.320 or later, or apply commit 66e7650dbbb8e236e781c670b167edc81e771450; rebuild and reboot systems with the fixed kernel; apply vendor backports where available for older distributions.

How to confirm the fix worked

Confirm kernel version reports 4.19.320 or newer; inspect ctnetlink expectation delete code paths for presence of nf_expect_get_id() call; test with local reproducer to verify no address LSB leakage occurs.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Open netfilter ctnetlink socket and prepare expectation objects
3. Issue delete expectation netlink request via missing helper path
4. Read leaked LSB from userspace response to map kernel memory layout
5. Leverage partial address for subsequent kernel exploitation attempts

How to detect it

Review kernel audit logs and netlink message traces for unusual ctnetlink expectation delete operations from unprivileged processes; examine system call logs for netfilter operations preceding any local privilege escalation attempts; no public exploitation artifacts reported.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant systems within standard patch cycles
• Monitor upstream stable kernel releases for additional backports
• Review local user privileges on systems running netfilter to limit exposure surface
• Incorporate kernel version checks into vulnerability scanning routines