CVE-2024-9042

What it actually does

The flaw permits an authenticated high-privileged user to escalate privileges on affected Windows worker nodes by exploiting a weakness in the real-time kernel handling on those systems.

Why it matters to the business

Organizations running real-time or NFV workloads on Red Hat Enterprise Linux 8 may face unauthorized access or control on Windows worker nodes, increasing risk of data exposure or service disruption; the low EPSS and absence from KEV reduce immediate urgency but the 594 days since publication still require planned remediation.

How an attack unfolds

An attacker with administrative access on a Windows worker node leverages the kernel flaw to bypass restrictions and obtain higher privileges, potentially allowing further lateral movement within container or virtualization environments.

How to fix it

Upgrade all listed kernel-rt packages on Red Hat Enterprise Linux 8 NFV and realtime installations to version 0:4.18.0-348.20.1.rt7.150.el8_5 or later; apply the update through standard package management and reboot worker nodes.

How to confirm the fix worked

Verify installed kernel-rt package versions match or exceed the fixed releases using rpm or dnf queries; confirm no vulnerable versions remain in the environment and test node functionality after reboot.

Typical attack path

1. Identify exposed Windows worker nodes running vulnerable kernel-rt packages on RHEL 8 NFV or realtime variants
2. Obtain high-privileged credentials on the node
3. Trigger the privilege escalation condition in the kernel
4. Execute arbitrary code or access restricted resources with escalated rights

How to detect it

Review system logs and package databases for installation or execution of vulnerable kernel-rt versions on RHEL 8 hosts; look for unexpected privilege changes or anomalous processes on Windows worker nodes.

What your security team should do

• Prioritize inventory of all RHEL 8 systems using kernel-rt for NFV or realtime to determine exposure scope
• Schedule upgrades to the fixed kernel versions during the next maintenance window
• Monitor for any post-upgrade compatibility issues on Windows worker nodes