CVE-2024-53141

What it actually does

In the Linux kernel ipset bitmap_ip_uadt handler, absence of IPSET_ATTR_IP_TO combined with presence of IPSET_ATTR_CIDR causes ip and ip_to values to be swapped; the subsequent range check on ip is omitted, allowing invalid ranges or out-of-bounds values to be accepted into the set.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption or invalid networking state, leading to privilege escalation, system crashes, or bypass of network access controls that rely on ipsets.

How an attack unfolds

A local attacker invokes the ipset userspace tool with a crafted add command that supplies a CIDR attribute but omits the IP_TO attribute; the kernel path stores swapped values without the missing range validation, corrupting internal bitmap state that is later abused for arbitrary kernel read/write or code execution.

How to fix it

Upgrade the Linux kernel to a version containing the range-check fix; for the listed Ruby packages on Ubuntu 14.04/16.04 apply the referenced package updates (ruby1.9.1 to 1.9.3.484-2ubuntu1.3, ruby2.0 to 2.0.0.484-1ubuntu2.4, ruby2.3 to 2.3.1-2~16.04) and reboot.

How to confirm the fix worked

Confirm the updated kernel or package version is installed, then verify that ipset commands with CIDR-only input now correctly reject out-of-range values; run regression tests exercising bitmap:ip sets.

Typical attack path

1. Obtain a local shell on a vulnerable Linux host
2. Locate or create an ipset of type bitmap:ip
3. Issue an ipset add command supplying only the CIDR attribute
4. Trigger subsequent ipset operations that dereference the invalid range
5. Leverage resulting kernel corruption for privilege escalation

How to detect it

Review system logs for unusual ipset command invocations or kernel oops/panic messages referencing bitmap_ip; inspect auditd or syslog entries around ipset usage; correlate with process creation of the ipset binary by non-admin users.

What your security team should do

• Prioritize kernel and listed Ruby package updates on all Ubuntu 14.04/16.04 systems within the next 30 days
• Audit any custom ipset automation for CIDR-only usage patterns
• Enable kernel lockdown or seccomp filters around ipset operations where feasible
• Monitor EPSS trend and threat actor reports for related Linux kernel LPE campaigns