CoreCVE
Back

HIGH

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Published Jan 2, 2024

Description

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

Affected products

Remediation

Vendor solution

In order to trigger the issue, it requires the ability to create user/net namespaces.

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:

# echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Red Hat statement

The upstream commit that introduced this flaw (5f68718b34a5 "netfilter: nf_tables: GC transaction API to avoid race with control plane") is not included in any shipped kernel releases of Red Hat Enterprise Linux 6, 7, and 8. Only local users with `CAP_NET_ADMIN` capability or root can trigger this issue. On Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability. The OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, therefore, it is also affected by this kernel vulnerability. A successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access. A local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching the namespace in the running OpenShift container will not bring necessary capabilities. This means that for OpenShift, the impact of this vulnerability is Low. Similar to the CVE-2023-32233 vulnerability, this has been explained in the following blog post as an example of a "Container escape vulnerability": https://www.redhat.com/en/blog/containers-vulnerability-risk-assessment

Red Hat mitigation

In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Metrics

Weaknesses (1)

CWE-416

Use After Free

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 2, 2024
Updated Mar 4, 2026
Reserved Jan 2, 2024
Link CVE-2024-0193
CISA Vulnrichment
Updated Jul 2, 2024
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2024-0193
Red Hat
Severity Important
Public date Jan 2, 2024
Links CVE-2024-0193 - Bugzilla