Use-after-free in Linux kernel netfilter ipset

1) Use-after-free

EUVDB-ID: #VU94230

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39503

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the list_set_kadd(), list_set_kdel(), list_set_utest(), list_set_uadd(), list_set_udel() and list_set_destroy() functions in net/netfilter/ipset/ip_set_list_set.c, within the call_rcu(), ip_set_destroy() and ip_set_net_init() functions in net/netfilter/ipset/ip_set_core.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3
http://git.kernel.org/stable/c/93b53c202b51a69e42ca57f5a183f7e008e19f83
http://git.kernel.org/stable/c/0f1bb77c6d837c9513943bc7c08f04c5cc5c6568
http://git.kernel.org/stable/c/390b353d1a1da3e9c6c0fd14fe650d69063c95d6
http://git.kernel.org/stable/c/2ba35b37f780c6410bb4bba9c3072596d8576702
http://git.kernel.org/stable/c/90ae20d47de602198eb69e6cd7a3db3420abfc08
http://git.kernel.org/stable/c/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.