CVE-2024-56637

What it actually does

Race condition in netfilter ipset allows user space to unload ip_set.ko while it requests a set type backend module, causing a kernel crash due to missing module reference after nfnl_unlock().

Why it matters to the business

Potential system crashes and denial of service on Linux hosts relying on ipsets for packet filtering or network policy, increasing operational downtime risk though low exploit likelihood per current metrics.

How an attack unfolds

An attacker or malicious process unloads the ip_set module immediately after nfnl_unlock() during a pending backend module request, exploiting the window to trigger the crash; no confirmed active campaigns by listed actors for this specific flaw.

How to fix it

Apply kernel patches that hold the module reference during backend requests; upgrade affected Linux distributions to versions containing the fix for CVE-2024-56637.

How to confirm the fix worked

Confirm updated kernel builds include the module reference hold; test by attempting concurrent ipset operations and module unloads without inducing crashes.

Typical attack path

1. Identify systems using ipset for netfilter rules
2. Trigger concurrent module unload via user space while a set type request is in progress
3. Insert delay after unlock to widen race window
4. Cause kernel panic on module reference failure

How to detect it

Review kernel logs for crashes or oops mentioning ip_set module unload or reference issues; inspect audit logs for unexpected module removal during netfilter operations.

What your security team should do

• Prioritize kernel updates on systems using ipsets
• Monitor for kernel oops or panic logs involving ip_set
• Restrict unprivileged module unload capabilities where possible
• Review EPSS and KEV status periodically for changes