What’s Vulnerable › Vulnerabilities
CVE-2024-0193: Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-01-02 · updated 2026-06-17
- Weakness: CWE-416
Description
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
Affected products
- Linux kernel: from 5.10.198 before 5.10.206; from 5.15.118 before 5.15.146; from 6.1.35 before 6.1.71; from 6.3.9 before 6.6.10 — fixed in 5.10.206, 5.15.146, 6.1.71, 6.6.10
- RedHat Codeready Linux Builder: 9.0
- RedHat Codeready Linux Builder For Eus: 9.2, 9.4, 9.6
- RedHat Codeready Linux Builder For Ibm Z Systems: 9.0_s390x
- RedHat Codeready Linux Builder For Ibm Z Systems Eus: 9.2_s390x, 9.4_s390x, 9.6_s390x
- RedHat Codeready Linux Builder For Power Little Endian: 9.0_ppc64le
- RedHat Codeready Linux Builder For Power Little Endian Eus: 9.2, 9.4_ppc64le, 9.6_ppc64le
- Red Hat Enterprise Linux: 9.2, 9.0
- RedHat Enterprise Linux For Arm 64: 9.4_aarch64, 9.6_aarch64, 9.0_aarch64
- RedHat Enterprise Linux For Arm 64 Els: 9.4_aarch64, 9.6_aarch64
- RedHat Enterprise Linux For Arm 64 Eus: 9.4_aarch64, 9.6_aarch64
- RedHat Enterprise Linux For Els: 9.2, 9.4, 9.6
- RedHat Enterprise Linux For Eus: 9.2, 9.4, 9.6
- RedHat Enterprise Linux For Ibm Z Systems: 9.2_s390x, 9.0_s390x, 9.4_s390x, 9.6_s390x
- RedHat Enterprise Linux For Ibm Z Systems Els: 9.2, 9.4_s390x, 9.6_s390x
- RedHat Enterprise Linux For Ibm Z Systems Eus: 9.2, 9.4_s390x, 9.6_s390x
- RedHat Enterprise Linux For Power Little Endian Els: 9.2, 9.4_ppc64le, 9.6_ppc64le
- RedHat Enterprise Linux For Power Little Endian Eus: 9.2, 9.0_ppc64le, 9.4_ppc64le, 9.6_ppc64le
- RedHat Enterprise Linux For Update Services For Sap Solutions: 9.2, 9.4, 9.6, 9.0
- RedHat Enterprise Linux Server Aus: 9.2, 9.4, 9.6
- RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 9.2, 9.4_ppc64le, 9.6_ppc64le, 9.0_ppc64le
- RedHat Openshift Logging: from 5.0 before 5.8.6 — fixed in 5.8.6
How to fix
Upgrade to a fixed version: Linux kernel 5.10.206, 5.15.146, 6.1.71, 6.6.10; RedHat Openshift Logging 5.8.6. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2024:1018
- https://access.redhat.com/errata/RHSA-2024:1019
- https://access.redhat.com/errata/RHSA-2024:1248
- https://access.redhat.com/errata/RHSA-2024:2094
- https://access.redhat.com/errata/RHSA-2024:4412
- https://access.redhat.com/errata/RHSA-2024:4415
- https://access.redhat.com/security/cve/CVE-2024-0193
- https://bugzilla.redhat.com/show_bug.cgi?id=2255653
- https://access.redhat.com/errata/RHSA-2024:1018
- https://access.redhat.com/errata/RHSA-2024:1019
- https://access.redhat.com/errata/RHSA-2024:1248
- https://access.redhat.com/errata/RHSA-2024:2094
Get alerted when CVE-2024-0193 or the next vulnerability affects your stack