CVE-2024-50257

What it actually does

Use-after-free in ip6table_nat get_info() when module unload races with table lookup, allowing module reference to be dropped after the table object is freed.

Why it matters to the business

Attackers with local access can trigger kernel warnings or crashes on systems running ip6table_nat, leading to denial of service and potential escalation to full system compromise on affected Linux kernels.

How an attack unfolds

An attacker with local access loads ip6table_nat, then concurrently unloads the module while performing getsockopt operations that call get_info(); the race allows a freed table pointer to be dereferenced and its module reference decremented, resulting in the observed UAF warning.

How to fix it

Upgrade to a kernel containing the fix for CVE-2024-50257; rebuild and reboot any systems using custom kernels. Disable ip6table_nat when IPv6 NAT is not required.

How to confirm the fix worked

Confirm the patch is present by checking for the re-traversal of xt_net->tables after xt_find_table_lock; verify module unload no longer produces the module_put warning under concurrent getsockopt load.

Typical attack path

1. Obtain local shell on target Linux system
2. Load ip6table_nat module and establish concurrent unload thread
3. Trigger repeated getsockopt calls on raw IPv6 sockets to invoke get_info()
4. Race module_exit path with table lookup to hit freed object
5. Escalate via kernel memory corruption or crash for denial of service

How to detect it

Search kernel logs for module_put warnings referencing ip6table_nat and get_info; inspect auditd or syscall logs for concurrent module unload and getsockopt activity on raw IPv6 sockets.

What your security team should do

• Apply kernel updates immediately on all systems exposing ip6table_nat
• Audit for unnecessary use of ip6table_nat and remove where possible
• Monitor for module unload events correlated with IPv6 socket operations
• Prioritize patching on internet-facing or multi-tenant Linux hosts