CVE-2024-53141: Linux Kernel Range Check Vulnerability

CVE-2024-53141 Overview

A missing range check vulnerability exists in the Linux kernel's netfilter ipset subsystem, specifically in the bitmap_ip_uadt function. When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are incorrectly swapped. The absence of proper range validation after this swap allows attackers with local access to potentially exploit this condition for privilege escalation or to compromise system confidentiality, integrity, and availability.

Critical Impact

Local attackers with low privileges can exploit the missing range check in the netfilter ipset bitmap_ip_uadt function, potentially leading to complete system compromise including unauthorized access to sensitive data, system modification, or denial of service.

Affected Products

• Linux Kernel (multiple versions)

Discovery Timeline

• December 6, 2024 - CVE-2024-53141 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-53141

Vulnerability Analysis

This vulnerability resides in the netfilter ipset implementation within the Linux kernel, specifically affecting the bitmap_ip_uadt function responsible for handling IP address ranges in bitmap-type IP sets. The core issue stems from improper handling of CIDR notation inputs when the explicit IP_TO attribute is absent.

When processing ipset commands that specify a CIDR block without an explicit end IP address, the kernel performs a swap operation on the ip and ip_to variables. However, the range validation check that should occur after this swap was missing from the code path. This oversight creates a window where invalid or out-of-bounds IP ranges can be processed by the kernel, potentially corrupting memory or causing other unintended behaviors.

The local attack vector requires an attacker to have user-level access to the system with the ability to interact with netfilter ipset functionality. While the attack complexity is low, successful exploitation can lead to high impact across confidentiality, integrity, and availability due to the kernel-level nature of the vulnerability.

Root Cause

The root cause is a missing input validation check in the bitmap_ip_uadt function. When handling CIDR notation through tb[IPSET_ATTR_CIDR] without an accompanying tb[IPSET_ATTR_IP_TO] attribute, the function performs a variable swap but fails to subsequently validate that the resulting IP range is within acceptable boundaries. This missing range check allows potentially malicious or malformed inputs to propagate deeper into the kernel's netfilter processing logic.

Attack Vector

The attack vector is local, requiring an attacker to have authenticated access to a vulnerable Linux system. Exploitation involves:

1. Crafting a specially formed ipset command that uses CIDR notation without specifying an explicit IP_TO value
2. The malformed input triggers the swap behavior in bitmap_ip_uadt
3. Due to the missing range check, invalid values propagate through the function
4. This can result in memory corruption, privilege escalation, or denial of service depending on the specific values used

The vulnerability requires local access and low privileges, with no user interaction needed for exploitation. The scope is unchanged, meaning the impact remains within the vulnerable kernel component but affects all security properties (confidentiality, integrity, availability) at a high level.

Detection Methods for CVE-2024-53141

Indicators of Compromise

• Unexpected kernel crashes or panics related to netfilter or ipset subsystems
• Anomalous ipset operations in system logs, particularly those involving CIDR notation
• Unusual privilege escalation events following ipset-related activities
• Memory corruption signatures in kernel dmesg output referencing netfilter components

Detection Strategies

• Monitor system logs for ipset-related errors or warnings using dmesg | grep -i ipset
• Implement kernel-level auditing for netfilter ipset operations using auditd rules
• Deploy endpoint detection solutions capable of monitoring kernel-level system calls related to netfilter
• Use SentinelOne's behavioral AI to detect anomalous patterns in netfilter subsystem interactions

Monitoring Recommendations

• Enable kernel audit logging for netfilter and ipset operations
• Configure alerting for unusual ipset commands, particularly those with complex CIDR specifications
• Monitor for process privilege changes following network configuration activities
• Implement regular kernel integrity checking to detect potential exploitation artifacts

How to Mitigate CVE-2024-53141

Immediate Actions Required

• Update the Linux kernel to the latest patched version for your distribution
• Review and restrict access to netfilter/ipset functionality to only necessary administrators
• Monitor systems for signs of exploitation while patch deployment is in progress
• Consider implementing additional access controls around ipset management capabilities

Patch Information

Multiple kernel patches have been released to address this vulnerability. The fix adds the missing range checks and removes unnecessary redundant checks in the bitmap_ip_uadt function. Patches are available through the official kernel git repository:

• Kernel Git Commit 15794835
• Kernel Git Commit 35f56c55
• Kernel Git Commit 3c20b594
• Kernel Git Commit 591efa49
• Kernel Git Commit 856023ef

Debian users should refer to the Debian LTS Security Announcements for distribution-specific patches.

Workarounds

• Restrict access to ipset commands to only trusted administrators using filesystem permissions or sudo rules
• Implement network namespace isolation to limit exposure of netfilter functionality
• Use SELinux or AppArmor policies to restrict processes that can interact with netfilter/ipset
• Monitor and audit all ipset operations while awaiting kernel updates

# Restrict ipset binary access to root only
sudo chmod 750 /usr/sbin/ipset
sudo chown root:root /usr/sbin/ipset

# Add audit rule for ipset operations
sudo auditctl -w /usr/sbin/ipset -p x -k ipset_exec

# Verify current kernel version
uname -r