Junglewise Threat Intelligence

CVE-2024-36005: Linux Kernel nf_tables double unregistration in netdev event handler

CVE-2024-36005 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue occurs when the system attempts to manage network interfaces while certain firewall tables are in a 'dormant' state. This can lead to a denial-of-service condition, impacting the availability of the affected server or device.

Technical details

A vulnerability exists in the nf_tables component of the Linux kernel's netfilter subsystem. The root cause is a failure to honor the NFT_TABLE_F_DORMANT flag within the nf_tables_netdev_event handler. When a netdev release event occurs, the kernel attempts to unregister hooks; if the table is already dormant, these hooks are already unregistered, leading to a double-unregistration and a kernel warning/oops (specifically in __nf_unregister_net_hook). This is a local attack vector requiring low privileges to trigger network device changes or namespace cleanups. Patches have been released for multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, and 6.8.

Affected products

  • Linux Linux Kernel 5.5 to 5.10.216, 5.11 to 5.15.158, 5.16 to 6.1.90, 6.2 to 6.6.30, 6.7 to 6.8.9, 6.9-rc1 to 6.9-rc5

Timeline

  • 2024-04-24: patched: Initial patch authored by Pablo Neira Ayuso
  • 2024-05-20: advisory: NVD publication date

References

Related threats