CVE-2024-53141 Overview
CVE-2024-53141 is a high-severity vulnerability in the Linux kernel's netfilter subsystem, specifically within the bitmap_ip_uadt function of the ipset module. The flaw exists because the kernel fails to perform a required range check on user-supplied IP values when IPSET_ATTR_IP_TO is absent but IPSET_ATTR_CIDR is provided. Under these conditions, ip and ip_to are swapped, and the missing validation creates an out-of-bounds memory access condition. A local user with CAP_NET_ADMIN capability can trigger the issue through crafted netlink messages to manipulate ipset configurations.
Critical Impact
Local attackers can exploit the missing range check to corrupt kernel memory, leading to privilege escalation, denial of service, or arbitrary kernel code execution.
Affected Products
- Linux Kernel (multiple stable branches prior to fix commits)
- Debian GNU/Linux (addressed in Debian LTS advisories)
- Linux distributions shipping unpatched kernels with ipset enabled
Discovery Timeline
- 2024-12-06 - CVE-2024-53141 published to the National Vulnerability Database (NVD)
- 2025-03 - Debian LTS security announcements published addressing the issue
- 2025-11-03 - Last updated in NVD database
Technical Details for CVE-2024-53141
Vulnerability Analysis
The vulnerability resides in the bitmap_ip_uadt function within the Linux kernel's netfilter ipset module. The ipset framework allows administrators to define sets of IP addresses, networks, or ports that iptables and nftables can reference for high-performance matching. When a user creates or modifies a bitmap:ip set type, the kernel parses netlink attributes describing the address range.
The parsing logic handles two attribute combinations: IPSET_ATTR_IP_TO for explicit end addresses, and IPSET_ATTR_CIDR for prefix-based ranges. When only IPSET_ATTR_CIDR is supplied, the kernel computes the range boundaries and effectively swaps the roles of ip and ip_to. The pre-existing range check executes before this swap, leaving the post-swap ip value unvalidated.
An unvalidated IP value can fall outside the bitmap's allocated range. Subsequent bitmap operations index memory based on this attacker-controlled value, producing out-of-bounds reads or writes in kernel address space.
Root Cause
The root cause is a missing bounds-check after attribute reassignment in bitmap_ip_uadt. The original code performed range validation on ip before the CIDR-based swap occurred, leaving the swapped value unchecked. This is classified as an input validation error in the kernel's netlink message handler.
Attack Vector
Exploitation requires local access and the CAP_NET_ADMIN capability, which is typically held by root or by processes in network namespaces. An attacker sends crafted netlink messages containing IPSET_ATTR_CIDR but omitting IPSET_ATTR_IP_TO, supplying IP values that bypass the original range check. In containerized environments where unprivileged users can hold CAP_NET_ADMIN within user namespaces, the attack surface expands significantly.
No verified exploit code examples are publicly available. The vulnerability mechanism is documented in the upstream commit messages referenced in the kernel.org stable tree.
Detection Methods for CVE-2024-53141
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing bitmap_ip_uadt or ip_set_bitmap_ip in dmesg output
- KASAN (Kernel Address Sanitizer) reports indicating out-of-bounds access in netfilter ipset code paths
- Unprivileged processes invoking ipset netlink operations from user namespaces
Detection Strategies
- Audit kernel version strings against the patched commits listed in the Linux kernel git history
- Monitor for setsockopt and sendmsg syscalls targeting NETLINK_NETFILTER from non-privileged processes
- Deploy eBPF probes to log ipset configuration changes, particularly those using CIDR without an explicit IP_TO value
Monitoring Recommendations
- Forward kernel logs and audit records to a centralized logging platform for correlation
- Alert on kernel crash signatures originating from netfilter modules across the fleet
- Track installed kernel package versions and flag hosts running unpatched builds
How to Mitigate CVE-2024-53141
Immediate Actions Required
- Update the Linux kernel to a version containing one of the fix commits: 15794835378e, 35f56c554eb1, 3c20b5948f11, 591efa494a1c, or 856023ef032d
- Apply distribution updates from the Debian LTS announcement on affected Debian systems
- Restrict CAP_NET_ADMIN assignments and limit creation of user namespaces for untrusted users
Patch Information
The Linux kernel maintainers resolved the issue by adding the missing range check after the CIDR-based attribute swap and removing the now-redundant earlier check. Patches were backported across multiple stable branches. Reference the upstream commit for the exact code change. Debian users should install updated kernel packages per the LTS advisories.
Workarounds
- Disable the ip_set kernel module on systems that do not require ipset functionality using modprobe -r ip_set and blacklisting the module
- Set kernel.unprivileged_userns_clone=0 via sysctl to prevent unprivileged user namespace creation, reducing exposure in container environments
- Restrict netlink access to the netfilter subsystem using SELinux or AppArmor policies on multi-tenant hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
