CVE-2024-1085: Linux Kernel Privilege Escalation Flaw

CVE-2024-1085 Overview

CVE-2024-1085 is a use-after-free vulnerability [CWE-416] in the Linux kernel's netfilter: nf_tables component. The flaw resides in the nft_setelem_catchall_deactivate() function, which incorrectly checks whether a catch-all set element is active in the current generation rather than the next generation before freeing it. The function only flags the element inactive in the next generation, allowing it to be freed multiple times. This double-free condition can be exploited by a local, low-privileged user to achieve privilege escalation on affected Linux systems.

Critical Impact
A local attacker with unprivileged user access can exploit this double-free condition in nf_tables to escalate privileges and gain root-level control of the system.

Affected Products

Linux Kernel (mainline, prior to commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7)
Distributions shipping vulnerable upstream nf_tables code
Systems with CONFIG_NF_TABLES enabled and unprivileged user namespace creation permitted

Discovery Timeline

2024-01-31 - CVE-2024-1085 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1085

Vulnerability Analysis

The vulnerability lives in the netfilter subsystem, specifically in how nf_tables handles catch-all set element deactivation. The nft_setelem_catchall_deactivate() function is responsible for marking a catch-all element inactive before it is freed during a transaction. The implementation contains a generation-tracking inconsistency that creates a window for double-freeing the same kernel object.

When a set element is deactivated, the kernel uses generation counters to coordinate visibility between the current and next generations of the ruleset. The buggy function checks the wrong generation when determining whether the element is still active. As a result, the kernel can pass the same catch-all element through the deactivation path more than once, freeing it on each pass.

The resulting double-free corrupts kernel slab allocator metadata. Attackers can leverage this corruption to overlap controlled objects with freed memory, enabling arbitrary write primitives and ultimately code execution in kernel context.

Root Cause

The defect is a generation-check error inside nft_setelem_catchall_deactivate(). The function inspects the element's active state in the current generation but only updates the inactive flag for the next generation. Repeated invocations during the same transaction observe the element as still active and free it again, producing the double-free.

Attack Vector

Exploitation requires local access with the ability to create and manipulate nf_tables rulesets. On distributions that allow unprivileged user namespaces, a standard user can obtain CAP_NET_ADMIN inside a namespace and reach the vulnerable code path without prior root privileges. The attacker crafts a sequence of nft_setelem operations targeting catch-all elements to trigger repeated deactivation and free the same object twice. After kernel heap grooming, the attacker reclaims the freed slot with a controlled object to corrupt kernel data structures and escalate to root.

No public proof-of-concept code is referenced in the advisory. Refer to the Linux Kernel Commit Log and the Kernel Dance Commit Details for the exact source-level change that closes the flaw.

Detection Methods for CVE-2024-1085

Indicators of Compromise

Kernel oops or panic logs referencing nft_setelem_catchall_deactivate or nf_tables in dmesg and /var/log/kern.log
KASAN or slab corruption warnings citing double-free or use-after-free in netfilter code paths
Unexpected nft or nftables invocations originating from non-administrative user sessions
New root-owned processes spawned from a child of an unprivileged shell shortly after netfilter syscalls

Detection Strategies

Monitor unshare, clone, and setns syscalls combined with rapid nf_tables Netlink traffic from unprivileged UIDs
Audit nft binary execution and direct NETLINK_NETFILTER socket use by non-root users
Correlate kernel ring-buffer crash signatures with subsequent UID transitions to root
Track loading and active use of the nf_tables kernel module on systems that do not require it

Monitoring Recommendations

Enable kernel auditing (auditd) rules for execve of /usr/sbin/nft and unexpected setuid transitions
Centralize kernel logs and alert on BUG:, KASAN:, or general protection fault strings tied to nf_tables
Baseline which users and containers legitimately interact with netfilter and alert on deviations

How to Mitigate CVE-2024-1085

Immediate Actions Required

Upgrade the Linux kernel to a version that includes commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 or apply the vendor backport from your distribution
Reboot affected systems after kernel update to load the patched image
Inventory hosts with nf_tables enabled and prioritize multi-tenant, container, and shared-user systems for patching

Patch Information

The fix is upstream commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7, which corrects the generation check in nft_setelem_catchall_deactivate() so that catch-all elements cannot be freed more than once. Apply the patched kernel package from your Linux distribution. See the Linux Kernel Commit Log for the authoritative change.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where the distribution exposes this sysctl
Blacklist the nf_tables module on systems that do not require it using /etc/modprobe.d/
Restrict access to the nft binary and NETLINK_NETFILTER sockets through mandatory access controls such as SELinux or AppArmor
Use seccomp profiles in container runtimes to block netfilter-related syscalls for untrusted workloads

bash

# Configuration example: reduce exposure on systems pending patch
# Disable unprivileged user namespaces (where supported)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2024-1085.conf
sudo sysctl --system

# Prevent the nf_tables module from loading if not required
echo 'install nf_tables /bin/true' | sudo tee /etc/modprobe.d/disable-nf_tables.conf

# Verify running kernel includes the fix commit
uname -r