Use after free vulnerability in kernel in Debian - CVE-2024-1086ID: oval:org.secpod.oval:def:99039 | Date: (C)2024-04-12 (M)2024-04-29 |
Class: VULNERABILITY | Family: unix |
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Platform: |
Debian 11.x |
Debian 12.x |
Debian 10.x |
Product: |
linux-support-6.1 |
linux-image-6.1 |
linux-headers-6.1 |
linux-support-5.10 |
linux-image-5.10 |
linux-headers-5.10 |
bpftool |
hyperv-daemons |
libcpupower-dev |
usbip |
linux-image-4.19 |
linux-headers-4.19 |
libcpupower1 |
libbpf-dev |
libbpf4.19 |
liblockdep-dev |
liblockdep4.19 |
lockdep |
linux-support-4.19 |