Junglewise Threat Intelligence

CVE-2024-44944: Linux Kernel information leak in Netfilter ctnetlink

CVE-2024-44944 · Severity: medium · CVSS 5.5 · Published 2024-08-30

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue exists in the Netfilter component, which handles network traffic filtering and connection tracking. While the primary impact is a denial of service (system instability), the flaw also inadvertently leaks internal memory address information to userspace.

Technical details

A vulnerability in the Netfilter ctnetlink component of the Linux kernel arises from a missing call to the nf_expect_get_id() helper function within the delete expectation path. This omission causes the least significant bits (LSB) of an internal kernel expectation object address to be leaked to userspace. An attacker with local access can exploit this flaw to trigger a denial of service (system crash) or potentially bypass security protections like KASLR by utilizing the leaked memory address information. The issue has been resolved across multiple stable kernel branches by ensuring the correct helper function is used to calculate and validate expectation IDs.

Affected products

  • Linux Linux Kernel 4.19.320, 5.1, 5.2 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.103, 6.2 to 6.6.44, 6.7 to 6.10.3

Timeline

  • 2024-08-30: disclosed
  • 2024-08-30: advisory
  • 2024-08-03: patched: Initial patches applied to stable trees.

References

Related threats