A vulnerability (CVE-2024-1086) has been identified in Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, enabling a local user to execute code at the kernel level and escalate privileges in the system. This issue is caused by a double-free in the nf_tables module, which manages the nftables packet filter. The security researcher who discovered the vulnerability has developed and published a working exploit prototype.
The exploit has been demonstrated in current releases of Debian and Ubuntu with Linux kernels 5.14 — 6.6, as well as in an environment using the KernelCTF (Capture the Flag) kernel, which includes additional patches to block common exploit methodologies and is utilized by Google in its vulnerability reward program. The success rate of the exploit is estimated at 99.4%. The accompanying article details the process of creating a complex multi-layer exploit and bypassing the existing protection and countermeasure mechanisms in the kernel.
The issue arises from an error in the nft_verdict_init() function, which allows positive values to be used as error codes for packet dropping (DROP) in hooks, which can be leveraged to trigger a second memory free operation in the nf_hook_slow() function for a buffer that has already been freed. The problem occurs when the NF_DROP operation is erroneously formed and the kernel initially interprets NF_DROP, but then frees the buffer and returns a status of NF_ACCEPT. This situation leads to the processing of the associated buffer not stopping despite it being freed, and it is passed to another handler that subsequently invokes the memory free function a second time.
The vulnerability manifests from kernel version 3.15 onwards, but the exploit works with kernels starting from version 5.14. The fix for the vulnerability has been proposed in the Linux kernel release 6.8-rc1 and was backported into stable branches 5.15.149, 6.1.76, and 6.6.15 at the end of February. The distributions can track the vulnerability fix on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.
Additionally, a series of vulnerabilities in the ksmbd module, which offers a built-in file system implementation in the Linux kernel based on the SMB protocol, can be noted. server The CVE-2024-26592 vulnerability allows remote code execution with kernel privileges without authentication on systems with the ksmbd module enabled. This issue arises from a race condition in the TCP connection handling code, which occurs due to a lack of proper locking when working with the object.
The CVE-2023-52440 vulnerability also allows remote code execution with kernel privileges, but is caused by a buffer overflow when processing invalid session keys due to inadequate size checks on data received from the user before copying it into a fixed-size buffer.
The vulnerabilities (1, 2, 3) CVE-2024-26594, CVE-2023-52442, and CVE-2023-52441 in ksmbd enable remote access to kernel memory contents without authentication. The CVE-2024-26594 vulnerability is caused by improper validation of data when processing incoming SMB2 Mech tokens, leading to data being returned from outside the buffer's boundary. The CVE-2023-52442 vulnerability is due to a lack of proper input validation when handling chained requests. The CVE-2023-52441 vulnerability results from insufficient input validation when processing SMB2 connection negotiation requests.
The vulnerabilities CVE-2024-26594 and CVE-2024-26592 have been fixed in kernel 6.8 and in corrective updates to previous stable branches 6.1.75, 6.6.14, and 6.7.2. The other vulnerabilities have been addressed in kernel 6.5 and updates 5.15.145, 6.1.53, and 6.4.16.
In conclusion, it is worth mentioning the activation of the new Linux kernel development team, established to analyze vulnerabilities and assess the correlation of kernel patches with security issues. In February, the kernel developers set up their own CNA (CVE Numbering Authority), which was granted authority to independently assign CVE identifiers to vulnerabilities. Previously, the assignment of CVEs and the analysis of the correlation of patches with potential vulnerabilities fell to the distribution developers, while potential vulnerabilities in the kernel were not highlighted and were treated the same as regular patches. The results of the new service's work exceeded all expectations—dozens of new vulnerabilities are marked daily in the kernel that were previously not flagged as security issues. For example, on March 26, new CVE identifiers were assigned to 14 vulnerabilities that were not previously considered security issues, and on March 25, 41 vulnerabilities were identified.
Source: opennet.ru
