CVE-2024-44945

What it actually does

Missing initialization of the extack structure before it is used when generating ACK responses for BATCH_BEGIN and BATCH_END messages in the nfnetlink subsystem, resulting in use of uninitialized kernel memory and potential information disclosure.

Why it matters to the business

Attackers with local access or the ability to interact with netfilter batch operations may obtain sensitive kernel memory contents, increasing the risk of further exploitation or data leakage on affected Linux systems; the issue affects widely deployed kernels with high ecosystem prevalence.

How an attack unfolds

An attacker sends crafted netfilter batch messages triggering BATCH_BEGIN or BATCH_END ACK paths; because extack is not zeroed, the kernel copies uninitialized stack or heap memory into the response, leaking data back to the attacker.

How to fix it

Upgrade the Linux kernel to version 6.10.7 or later, or apply the commit 3e03b536d9454c5802168b9e85248d456d3ff6a3; HashiCorp Vault users should upgrade to 1.8.4 or 1.7.5 if the packaged kernel component is affected.

How to confirm the fix worked

Confirm the running kernel version is 6.10.7 or newer, or verify the presence of the extack initialization patch in the nfnetlink source; test by sending BATCH_BEGIN/END messages and ensuring no uninitialized data appears in responses.

Typical attack path

1. Obtain local access or sufficient privileges to interact with netfilter via nfnetlink
2. Craft and transmit BATCH_BEGIN or BATCH_END messages that force ACK generation
3. Inspect the returned ACK messages for uninitialized kernel memory contents
4. Use leaked data to bypass ASLR, locate kernel structures, or chain into further exploits

How to detect it

Review kernel logs and netfilter audit records for unusual BATCH_BEGIN or BATCH_END activity; inspect outbound nfnetlink ACK packets for anomalous payload sizes or contents that deviate from expected empty or properly initialized extack structures.

What your security team should do

• Prioritize kernel upgrades on all production systems within the next 30 days given the CVSS 7.8 rating
• Monitor for new exploit code or EPSS increases and reassess urgency if EPSS rises
• Apply the fix via distribution package managers or rebuild kernels with the referenced commit
• Restrict unprivileged access to netfilter batch operations where possible until patched