CVE-2024-53168 Overview
CVE-2024-53168 is a use-after-free vulnerability [CWE-416] in the Linux kernel's sunrpc subsystem. The flaw affects the kernel TCP socket used by SUN Remote Procedure Call (SunRPC), which underlies Network File System (NFS) client operations. When a network namespace is deleted while a TCP retransmission timer is still armed on a sunrpc socket, the timer handler dereferences freed net structure memory. The result is memory corruption in tcp_write_timer_handler, detectable through Kernel Address Sanitizer (KASAN) reports. Local users with the ability to create and delete network namespaces can trigger the condition, leading to kernel memory corruption and potential privilege escalation on Linux systems running vulnerable kernel builds.
Critical Impact
A local unprivileged actor able to manipulate network namespaces and NFS mounts can trigger a kernel use-after-free, causing memory corruption, denial of service, or potential privilege escalation.
Affected Products
- Linux Kernel (mainline builds prior to the fix commits in the stable tree)
- Distributions shipping affected sunrpc kernel module builds
- NFS client deployments using kernel TCP transport across network namespaces
Discovery Timeline
- 2024-12-27 - CVE-2024-53168 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-53168
Vulnerability Analysis
The vulnerability resides in the sunrpc kernel TCP socket lifecycle. When the NFS client shuts down the TCP socket through xs_destroy, the socket is closed on the client side. If the peer discards the FIN acknowledgement, for example due to an iptables rule dropping FIN packets, the server continues to retransmit. The receiving TCP stack then processes retransmitted segments and re-arms tcp_write_timer to flush the send queue.
When the enclosing network namespace is destroyed by cleanup_net, the associated struct net is freed by kmem_cache_free. The TCP write timer, still scheduled, later fires and calls tcp_write_timer_handler, which dereferences the freed namespace. KASAN reports a slab-use-after-free read at tcp_write_timer_handler+0x156/0x3e0.
Root Cause
The sunrpc TCP kernel socket did not hold a reference count on the network namespace it belonged to. Consequently, cleanup_net released the namespace while an asynchronous TCP retransmission timer still referenced it. The fix acquires a netns refcount for the sunrpc kernel TCP socket, matching the pattern used in other kernel modules that create long-lived sockets tied to a namespace.
Attack Vector
Exploitation requires local access with the capability to create network namespaces, mount NFS shares, and manipulate netfilter rules. The reproducer creates a network namespace, establishes an NFS v4.1 mount over TCP, installs an iptables rule dropping outbound TCP FIN packets, and then deletes the namespace. The pending tcp_write_timer fires against freed memory, corrupting kernel state. No remote or authenticated network path is required. See the upstream fix commit for the applied patch.
Detection Methods for CVE-2024-53168
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in tcp_write_timer_handler in kernel logs or dmesg output.
- Unexpected kernel oops or panic traces originating from tcp_write_timer, call_timer_fn, or run_timer_softirq shortly after network namespace teardown.
- Repeated NFS TCP retransmissions followed by cleanup_net worker activity in kernel traces.
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free reads in the sunrpc and TCP paths.
- Monitor kernel ring buffer messages for sunrpc transport errors correlated with unshare or ip netns del operations.
- Audit user activity for unprivileged invocation of unshare(CLONE_NEWNET) combined with NFS mount operations.
Monitoring Recommendations
- Alert on non-root processes issuing unshare syscalls that create network namespaces on production hosts.
- Track kernel crash telemetry and forward dmesg panics to a centralized logging or SIEM pipeline for triage.
- Baseline NFS client sessions and flag mounts inside short-lived network namespaces, which fit the exploitation pattern.
How to Mitigate CVE-2024-53168
Immediate Actions Required
- Apply the upstream stable-tree patches referenced in the vendor advisory to all affected kernel branches.
- Rebuild and redeploy custom kernels that include the sunrpc subsystem after integrating the fix.
- Restrict the ability of unprivileged users to create network namespaces where operationally acceptable.
Patch Information
The fix is committed across multiple stable branches. Relevant references include the Linux Kernel Commit 0ca87e50, Commit 3f23f965, Commit 61c0a5ea, and Commit 694ccb05. The patch causes the sunrpc kernel TCP socket to hold a reference on its network namespace, preventing premature release while timers remain scheduled.
Workarounds
- Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions that support it, reducing the ability to create nested network namespaces.
- Avoid mounting NFS shares inside short-lived network namespaces on unpatched kernels.
- Enforce netfilter policy that prevents dropping TCP FIN packets on NFS client hosts, which removes the observed trigger condition.
# Disable unprivileged network namespace creation until kernel is patched
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2024-53168.conf
# Verify installed kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
