Dogan Genc ⚡️
CVE-2024-1086

CVE-2024-1086


KERNEL Privilege Escalation

About CVE-2024-1086

The vulnerability identified as CVE-2024-1086 is a simple privilege escalation flaw. This vulnerability can be exploited by unauthorized individuals or malicious software that gains access to the computer through unwanted means.
In terms of severity, the CVSS score is 7.8 out of 10. The success rate for the attack on Linux kernel v6.4.16 is approximately 99.4% (n=1000) - sometimes dropping to 93.0% (n=1000).
This vulnerability was patched by the end of January 2024.

How CVE-2024-1086 Works


The fundamental flaw is a netfilter input sanitization error. The exploitation requirements include enabling nf_tables and enabling guest user namespaces.
This vulnerability is a type of "data-only" exploit, which is only carried out by manipulating data. Therefore, it does not require arbitrary code execution in the kernel memory space; instead, the attacker maliciously manipulates existing data structures or resources in the kernel.
The attack is carried out using the novel Dirty Pagedirectory technique, known as the user-kernel-space mirroring attack (KSMA). This attack moves any physical address, along with its permissions, to a memory address. This means that by moving a physical address with root privileges into memory, the attacker could gain root privileges.

Requirements of the Attack

This vulnerability exists between Linux kernel versions 5.14 and 6.6.14. Additionally, there's a possibility it may also be present in version 6.7.1 of the Linux kernel.
To exploit this vulnerability, user namespaces must be enabled (kconfig CONFIG_USER_NS=y), these user namespaces should not be privileged (achieved with the 'sh' command sysctl kernel.unprivileged_userns_clone = 1), and nf_tables must be enabled (kconfig CONFIG_NF_TABLES=y). By default, these features are active on Debian, Ubuntu, and KernelCTF systems.
In cases of high network activity on systems, the attack may be unstable. Systems with WiFi adapters can be particularly unstable when surrounded by high-traffic WiFi networks.

PoC

The following code is sufficient to execute line by line to successfully carry out the attack: 
git clone https://github.com/Notselwyn/CVE-2024-1086
cd CVE-2024-1086
make
./exploit

To Fix the Vulnerability

To address the vulnerability, you have two options:

Upgrade your Linux kernel version to 6.6.16 or higher. This version contains the necessary patches to fix the vulnerability.

Or you can download the patch from the following link: Patch Link

Sources

  • https://www.theregister.com/2024/03/29/linux_kernel_flaw/
  • https://nvd.nist.gov/vuln/detail/CVE-2024-1086
  • https://github.com/Notselwyn/CVE-2024-1086
  • https://pwning.tech/nftables/#2-background-info
    •
    © 2024