PT-2024-8931 · Linux+6 · Linux Kernel+6
Dong Chenchen
·
Published
2024-10-30
·
Updated
2025-10-03
·
CVE-2024-50257
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
The issue is related to a use-after-free vulnerability in the
get info() function of the Linux kernel's netfilter component. This vulnerability can be triggered by concurrent execution of module unload and get info() calls, leading to a potential impact on the confidentiality, integrity, and availability of protected information. The root cause of the issue is due to the removal of the xt table module from the xt templates list while still trying to access its memory.Recommendations:
To resolve the issue, update to Linux kernel version 6.6.61 or later. As a temporary workaround, consider disabling the
ip6table nat module until a patch is available. Restrict access to the vulnerable get info() function to minimize the risk of exploitation. Avoid using the xt find table lock function in the affected API endpoint until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu