CVE-2024-26581: Linux Kernel netfilter UAF — Root Through Connection Tracking

TL;DR

CVE-2024-26581 is a critical use-after-free (UAF) vulnerability in the Linux kernel's netfilter connection tracking (conntrack) code that could be exploited by unprivileged local users to gain root privileges. The flaw exists in the handling of network namespaces and affects kernel versions prior to 6.7.6, with stable branch backports addressing earlier versions.

Affected versions

• Linux kernel versions 5.15 through 6.7.5 (mainline)
• Specific vulnerable ranges:
  • 6.6.x prior to 6.6.15
  • 6.1.x prior to 6.1.76
  • 5.15.x prior to 5.15.148
  • 5.10.x prior to 5.10.209
• Affects both x86_64 and ARM64 architectures
• Container environments particularly at risk due to namespace manipulation capabilities
• Major distributions: Ubuntu 22.04/23.10, Debian 12, RHEL 8/9, Fedora 38-39 (pre-patch)

Root cause

The vulnerability resides in net/netfilter/nf_conntrack_core.c, specifically in the interaction between connection tracking garbage collection and network namespace cleanup.

Netfilter's conntrack maintains a hash table of active network connections for stateful packet filtering. When network namespaces are destroyed (common in container operations), the cleanup path must safely deallocate conntrack entries associated with that namespace.

The UAF occurs due to a race condition in the reference counting mechanism:

1. Reference counting flaw: When a conntrack entry is accessed during namespace destruction, the code path in nf_ct_iterate_cleanup_net() would iterate over conntrack entries and mark them for deletion

2. Timing window: Between checking if a conntrack entry should be deleted and actually freeing it, another CPU could:

   • Access the same conntrack entry through a packet processing path
   • Increment the reference count
   • Continue using the entry

3. Premature free: The cleanup code would proceed to free the conntrack structure despite the outstanding reference, because the reference count check and the actual free operation were not properly serialized

4. Use-after-free: Subsequent packet processing on other CPUs would dereference the freed conntrack structure, accessing freed memory

The root cause was the lack of proper RCU (Read-Copy-Update) grace periods and insufficient locking between the cleanup path and the fast path packet processing. The code assumed that reference counting alone would protect against this race, but the check-then-free pattern was not atomic.

Exploitation primitive

Exploitation requires local access and the ability to create network namespaces (available to unprivileged users on many modern distributions):

Race condition trigger:

• Create a new network namespace
• Establish multiple network connections to populate the conntrack table
• Trigger namespace destruction while simultaneously sending packets that match existing conntrack entries
• Time the operations to hit the race window (typically 1-50ms depending on system load)

Heap manipulation:

• Use heap spraying techniques to control allocations following the freed conntrack structure
• Conntrack entries are allocated from kmalloc-256 slab cache
• By repeatedly creating/destroying namespaces and connections, attackers could groom the heap to place controlled objects in the freed location

Control flow hijack:

• Freed conntrack structures contain function pointers (notably destroy callback pointers)
• By replacing freed memory with attacker-controlled data, these pointers could be hijacked
• When the UAF occurs, subsequent dereferences would call attacker-controlled addresses

Privilege escalation:

• Pivot to ROP chain execution in kernel context
• Disable SMEP/SMAP protections
• Modify cred structure to gain root UID
• Return to userspace with elevated privileges

Public exploits demonstrated reliable root access with ~70% success rate, requiring ~30 seconds of exploitation time on 4-core systems. The race becomes easier to win on systems with higher CPU counts.

Mitigation

Immediate actions:

• Upgrade to patched kernel versions: 6.7.6+, 6.6.15+, 6.1.76+, 5.15.148+, or 5.10.209+
• For Ubuntu: apt update && apt upgrade linux-image-generic
• For RHEL/Fedora: dnf upgrade kernel
• Reboot required to load patched kernel

Workarounds (if immediate patching impossible):

• Restrict network namespace creation: sysctl -w user.max_net_namespaces=0
• Disable unprivileged user namespaces: sysctl -w kernel.unprivileged_userns_clone=0
• These break containerized applications but prevent exploitation

Defense-in-depth:

• Enable kernel hardening options (KASLR, SMEP, SMAP, KPTI)
• Deploy kernel runtime protection (grsecurity, SELinux strict policies)
• Monitor for suspicious namespace creation patterns
• Use seccomp filters to restrict namespace syscalls in containers

The fix: Patches added proper RCU synchronization (synchronize_rcu()) before freeing conntrack entries and strengthened reference counting checks to be atomic with respect to the free operation. Additional validation ensures conntrack entries cannot be accessed after cleanup begins.