CVE-2024-1086: Linux kernel nf_tables use-after-free enabling container escape

TL;DR

A critical use-after-free flaw in Linux kernel's nf_tables (netfilter tables) allowed attackers with CAP_NET_ADMIN in unprivileged user namespaces to trigger double-free conditions, leading to kernel memory corruption. Successfully exploited for privilege escalation and container escape, affecting default configurations of major distributions.

Affected versions

• Linux kernel versions 3.15 through 6.6.14 (pre-patch)
• All major distributions: Ubuntu 20.04-23.10, RHEL 8-9, Debian 11-12, SUSE SLES 15
• Container runtimes: Docker, Podman, Kubernetes (when using vulnerable host kernels)
• Android devices with kernels based on affected versions
• WSL2 instances running vulnerable kernel versions

The vulnerability existed since the initial nf_tables implementation in kernel 3.15 (2014), remaining exploitable for nearly a decade. Configurations allowing unprivileged user namespace creation (Ubuntu default, kernel.unprivileged_userns_clone=1) were particularly vulnerable.

Root cause

The vulnerability resided in the nf_tables verdict expression lifetime management within net/netfilter/nft_immediate.c. Specifically, the nft_immediate_deactivate() function contained a logic error in handling verdict expressions during transaction abort scenarios.

When an nf_tables transaction is aborted, the kernel walks through bound objects to clean up resources. The vulnerable code path:

c copy
static void nft_immediate_deactivate(const struct nft_ctx *ctx,
                                      const struct nft_expr *expr,
                                      enum nft_trans_phase phase)
{
    const struct nft_immediate_expr *priv = nft_expr_priv(expr);
    if (nft_immediate_is_verdict(priv) && phase == NFT_TRANS_ABORT) {
        nft_verdict_put(ctx, &priv->data);
    }
}

The flaw occurred when:

1. A rule with verdict expression was added in a transaction
2. The transaction was intentionally aborted (via malformed subsequent rule)
3. nft_immediate_deactivate() freed the verdict object
4. The transaction cleanup code freed the same verdict object again

This created a classic double-free condition on the nft_chain structure referenced by the verdict. The kernel's SLUB allocator would then return the same memory region for subsequent allocations, allowing type confusion between kernel objects.

Exploitation primitive

The exploitation leveraged the double-free to achieve kernel memory corruption through heap feng shui:

Phase 1 - Setup: Create an unprivileged user namespace, gaining CAP_NET_ADMIN within that namespace. This is sufficient for nf_tables operations despite lacking system-wide privileges.

Phase 2 - Trigger double-free:

• Create nf_tables with verdict expressions pointing to chains
• Craft transactions that abort, triggering nft_immediate_deactivate()
• Spray the operation to reliably hit the double-free path

Phase 3 - Heap grooming:

• Free and reallocate kernel objects of similar size to nft_chain structures
• Target objects include msg_msg structures (excellent for read/write primitives) or pipe_buffer structures
• Spray allocations to reclaim the freed memory with attacker-controlled data

Phase 4 - Type confusion:

• Reuse the freed chain memory as a msg_msg structure
• Use msgrcv/msgsnd to read/write arbitrary kernel memory
• Leak kernel addresses to defeat KASLR

Phase 5 - Privilege escalation:

• Overwrite modprobe_path to execute arbitrary code as root
• Or corrupt cred structures to grant full capabilities
• Or manipulate function pointers in kernel structures for RIP control

Container escape path: From within a container, use the kernel exploit to gain host root privileges, then:

• Manipulate cgroup settings to escape namespace isolation
• Mount host filesystem from container
• Execute code in host namespace

Public exploits demonstrated reliable exploitation across Ubuntu, Debian, and RHEL systems with success rates exceeding 90%.

Mitigation

Immediate kernel patching:

• Update to kernel versions 6.6.15+, 6.7.3+, or distribution-specific patched kernels
• RHEL/CentOS: Update to kernel-5.14.0-362.18.1 or later
• Ubuntu: Update via standard apt upgrade (kernels 5.15.0-97.107+, 6.5.0-21.21+)
• Debian: Install linux-image packages version 6.1.76-1 or later

Workaround for delayed patching:

• Disable unprivileged user namespaces: sysctl kernel.unprivileged_userns_clone=0
• Note: This breaks rootless containers (Podman, Docker rootless mode)
• Restrict nf_tables access via AppArmor/SELinux policies

Container security hardening:

• Drop CAP_NET_ADMIN from container capabilities (add to --cap-drop)
• Use seccomp profiles blocking nf_tables syscalls
• Deploy gVisor or Kata Containers for stronger isolation
• Enable kernel lockdown mode (confidentiality or integrity)

Detection strategies:

• Monitor for nf_tables usage from within containers (auditd rules for nft syscalls)
• Alert on unprivileged user namespace creation in production environments
• Watch for kernel crashes in netfilter subsystem (dmesg, kernel panic logs)
• Deploy runtime security agents (Falco) with rules detecting exploitation patterns

Infrastructure response:

• Prioritize patching for multi-tenant systems and container platforms
• Audit container images for privilege escalation tools
• Review security policies for excessive container capabilities
• Consider temporary disablement of unprivileged containers until patching completes

This vulnerability highlights the risk of privileged operations accessible via namespace capabilities, a growing attack surface as containerization proliferates.