A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.
We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-debug-coreUpgrade kernel-64k-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-develUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-docUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-extraUpgrade kernelUpgrade rtlaUpgrade kernel-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-modules-coreUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modules-coreUpgrade bpftoolUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade perfUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debugUpgrade kernel-rt-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-64kUpgrade kernel-toolsUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-develUpgrade kernel-64k-debug-modulesUpgrade rvUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matched | Nov 4, 2024 | Jan 31, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.148-97.158Upgrade kernelUpgrade bpftoolUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-devel | Feb 21, 2024 | Jan 31, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extraUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-libbpfUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade kernel-livepatch-6.1.75-99.163Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade bpftool-debuginfo | Feb 17, 2025 | Jan 31, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jan 31, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Mar 12, 2024 | Jan 31, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Feb 29, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade dtb-lgUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade kernel-rt-optionalUpgrade dtb-amazonUpgrade kernel-default-optionalUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-azureUpgrade dtb-alteraUpgrade kernel-devel-azureUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-debug-vdsoUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-azureUpgrade dtb-appleUpgrade kernel-azureUpgrade kernel-default-develUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade dtb-exynosUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatchUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade kernel-sourceUpgrade kernel-source-rtUpgrade dtb-qcomUpgrade dtb-caviumUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade dtb-armUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade dtb-apmUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade dtb-rockchipUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade dlm-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade kernel-debugUpgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade dtb-xilinxUpgrade kernel-defaultUpgrade kernel-devel-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kernel-default-extraUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-base | Feb 15, 2024 | Jan 31, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04Upgrade linux-image-6.5.0-1017-azureUpgrade linux-image-5.15.0-101-generic-64kUpgrade linux-image-azureUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-101-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-starfiveUpgrade linux-image-5.15.0-1053-gkeUpgrade linux-image-6.5.0-26-genericUpgrade linux-image-gke-5.15Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1059-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-5.15.0-1047-nvidia-lowlatencyUpgrade linux-image-6.5.0-26-generic-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1056-awsUpgrade linux-image-6.5.0-1010-starfiveUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-6.5.0-1018-oemUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1054-oracleUpgrade linux-image-6.5.0-1017-azure-fdeUpgrade linux-image-6.1.0-1035-oemUpgrade linux-image-oem-20.04cUpgrade linux-image-kvmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1054-gcpUpgrade linux-image-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.5.0-1012-laptopUpgrade linux-image-raspiUpgrade linux-image-6.5.0-26-lowlatency-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1019-oracle-64kUpgrade linux-image-5.15.0-101-genericUpgrade linux-image-gkeopUpgrade linux-image-laptop-23.10Upgrade linux-image-awsUpgrade linux-image-6.5.0-1013-raspiUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1049-raspiUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1047-nvidiaUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1053-kvmUpgrade linux-image-5.15.0-1051-intel-iotgUpgrade linux-image-6.5.0-1016-gcpUpgrade linux-image-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-6.5.0-1019-oracleUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1049-ibmUpgrade linux-image-intelUpgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-1016-awsUpgrade linux-image-5.15.0-101-generic-lpaeUpgrade linux-image-5.15.0-101-lowlatency-64kUpgrade linux-image-5.15.0-1059-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1039-gkeopUpgrade linux-image-6.5.0-26-lowlatency | Mar 12, 2024 | Jan 31, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub