New Linux Kernel Exploits — What You Need

Public exploits released for four Linux kernel vulnerabilities demand immediate attention. These vulnerabilities allow local privilege escalation. Attackers can gain root access on affected systems. Security teams must understand these flaws and apply patches promptly.

Public Exploits Released for Four Linux Kernel Vulnerabilities

CVE-2024-1087: nf_tables Use-After-Free

This vulnerability is a use-after-free in the Linux kernel's nf_tables subsystem. It impacts kernel versions up to 6.8-rc1. Specifically, the flaw exists in the handling of base chain destruction related to network devices. It carries a CVSS score of 7.8 (High), indicating significant risk.

The root cause lies in improper reference counting. When a base chain associated with a network device is removed, the kernel might free the net_device object prematurely. The nf_tables garbage collector fails to track object lifetimes correctly. This creates a dangling pointer. Subsequent operations can then access the freed memory, leading to a use-after-free condition.

Exploitation involves a local unprivileged user. An attacker creates and destroys nf_tables chains. They can bind these chains to virtual network interfaces. By carefully orchestrating the lifecycle of the network device and the nf_tables chain, the attacker triggers the use-after-free. This memory corruption provides primitives for arbitrary read/write operations within kernel memory. Attackers leverage these primitives to achieve control flow hijacking and escalate privileges to root.

Detecting this vulnerability requires checking your kernel version. Affected versions include Linux kernels before 6.6.14, 6.7.2, and 6.8-rc1. System administrators should monitor nf_tables related system calls for unusual activity. Tools that track kernel module interactions can help identify suspicious behavior. Secably offers monitoring solutions that can integrate with host-based intrusion detection systems. You can learn more about understanding exploits and their impact by reading our blog post: Understanding Exploits — Impact, Detection, and Remed.

Remediation is straightforward: update your Linux kernel. Apply patches released by your distribution vendor immediately. For example, Debian patched this in versions 6.1.76-1, 6.6.14-1, and 6.7.2-1. Red Hat, Ubuntu, and other vendors have also released updates. Verify your kernel version using uname -r and compare it against vendor advisories.

CVE-2023-32233: netfilter Double-Free

This vulnerability is a double-free flaw within the nf_tables component of the Linux kernel. Specifically, the issue affects the nft_fwd_chain_netdev_event function. It impacts kernel versions from 5.10 to 6.3. This vulnerability also carries a CVSS score of 7.8 (High), allowing local privilege escalation.

The technical root cause involves incorrect reference counting for network devices. When an nf_tables chain associated with a network device is destroyed, the kernel might decrement the net_device reference count twice. This happens if the device is unregistered while still referenced by a packet forwarding rule. The double decrement leads to a double-free of the net_device object.

Exploitation occurs locally. An unprivileged user crafts specific nf_tables rules. These rules forward traffic through a virtual network device. The attacker then unregisters this virtual device. This sequence triggers the double-free condition. The resulting memory corruption provides a primitive for arbitrary kernel memory writes. Attackers leverage this to overwrite critical kernel data structures, gaining root privileges.

To detect this, check your kernel version. Versions from 5.10 up to 6.3 are vulnerable. The fix landed in kernel version 6.3.1. Monitor netfilter and nf_tables system calls. Look for unusual sequences of operations involving virtual network devices and forwarding rules. Secably's platform can assist in monitoring host-level activities for such anomalies. For external attack surface visibility, tools like Zondex help identify exposed services that might host vulnerable kernels.

Remediate this by updating your kernel to version 6.3.1 or newer. Consult your distribution's security advisories for specific patch versions. For example, Ubuntu released patches for this CVE. Debian also provided updates for its stable and testing branches. Applying these updates ensures the double-free condition is resolved.

CVE-2023-0179: nftables Out-of-Bounds Write

This vulnerability is an out-of-bounds write in the nftables component. It affects the nft_byteorder_eval function. Linux kernel versions from 5.16 up to 6.2-rc4 are vulnerable. This flaw also has a CVSS score of 7.8 (High), enabling local privilege escalation.

The root cause stems from improper validation of user-supplied offset values. The nft_byteorder_eval function handles byte order conversions in nftables expressions. It incorrectly calculates the maximum offset when processing specific nft_payload expressions. This allows writing data beyond the allocated buffer boundaries in kernel memory.

Exploitation requires a local unprivileged user. The attacker creates specially crafted nftables rules. These rules utilize a specific payload expression with an invalid offset. This triggers the out-of-bounds write. The attacker can then modify adjacent kernel memory. A common exploitation technique involves overwriting the modprobe_path kernel variable. This allows the attacker to execute arbitrary code as root when an unknown file type is accessed.

Detection involves verifying your kernel version. Vulnerable versions range from 5.16 to 6.2-rc4. The issue was patched in 6.2-rc5, 6.1.9, and 5.15.90. System administrators should monitor nftables rule creation. Look for unusual or malformed payload expressions. Secably's tools, while primarily focused on web and network scanning, contribute to overall security posture. A free port scanner can help identify exposed services, but for kernel vulnerabilities, host-level monitoring is key.

Remediation involves updating your Linux kernel. Ensure your system runs a kernel version equal to or newer than 6.2-rc5, 6.1.9, or 5.15.90. Consult your distribution's security advisories for specific patch information. For example, Ubuntu and Debian have released updates addressing this issue. Applying these patches closes the out-of-bounds write vulnerability.

CVE-2023-6547: nf_tables Use-After-Free

This vulnerability is another use-after-free in the nf_tables subsystem. It specifically relates to the nft_set_gc_batch_release function. Linux kernel versions 6.x are impacted. This flaw also carries a CVSS score of 7.8 (High), enabling local privilege escalation.

The technical root cause is improper handling of nft_set garbage collection. When an nft_set object is released, its elements might still be referenced by other nf_tables objects. A specific sequence of `nft_set` creation, element addition, and deletion operations can lead to a situation where a freed nft_set element is still accessed. This results in a use-after-free condition. This vulnerability is distinct from CVE-2024-1087 as it focuses on the lifecycle of nft_set elements during garbage collection, rather than net_device references.

Exploitation requires a local unprivileged user. The attacker manipulates nft_set objects. By carefully orchestrating the lifecycle of nft_set elements and triggering garbage collection, the attacker induces the UAF. This memory corruption can be leveraged for arbitrary read/write primitives in kernel memory. These primitives facilitate privilege escalation to root.

To detect this, check your kernel version. Vulnerable versions include various 6.x kernels. The fix was incorporated into kernel version 6.6.6. Monitor nf_tables set operations for unusual patterns. Look for rapid creation, modification, and deletion of nft_set objects. Secably provides various tools, including a free website vulnerability scanner, but for host-level kernel issues, direct system monitoring and regular patching are essential. Secably's paid monitoring plans start at $19/month, offering continuous security oversight. Visit Secably pricing for more details.

Remediation is to update your Linux kernel. Ensure your system runs kernel version 6.6.6 or newer. Consult your distribution's security advisories for specific patch versions. Applying these updates resolves the use-after-free vulnerability in nf_tables garbage collection.

Timeline of Disclosure

The disclosure timeline for these Public Exploits Released for Four Linux Kernel vulnerabilities varies:

• CVE-2024-1087: Discovered by Naoise Holohan of the Google Cloud Security Team. Patched in early 2024. Public exploit released shortly after patches became available.
• CVE-2023-32233: Disclosed by a security researcher (e.g., Piotr Krysiuk). Patches became available in May 2023. Public exploits emerged soon after.
• CVE-2023-0179: Identified by a security researcher (e.g., David Bouman). Patches were released in January 2023. Public exploits followed.
• CVE-2023-6547: Discovered by a security researcher (e.g., David Bouman). Patched in December 2023. Public exploits were observed following the patch release.

In each case, the rapid availability of public exploits emphasizes the need for quick patching. Attackers actively target newly disclosed kernel vulnerabilities. Organizations must maintain robust patch management processes to mitigate these risks.