PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in Linux’s nftables firewall subsystem.

The flaw allows local attackers to escalate privileges and execute arbitrary code, posing significant risks to unpatched systems.

Technical Breakdown of CVE-2024-26809

nftables, the modern replacement for legacy iptables, manages network packet filtering through components like tables, sets, and rules.

According to the Github report, the vulnerability resides in its pipapo set implementation, which uses a “Packet Processing Pipeline” for efficient rule matching.

The double-free occurs in nft_pipapo_destroy() when a set marked as “dirty” (modified but not committed) is deleted.

The function fails to check whether elements exist in both the live match and backup clone structures, leading to repeated deallocations of the same memory:

static void nft_pipapo_destroy(...) {

  ...

  if (priv->dirty)

    nft_set_pipapo_match_destroy(ctx, set, m); // Double-free triggered here

  ...

}

Exploitation Steps

1. Trigger the Flaw:
   • Create a pipapo set A with two elements (B, C), marking it dirty.
   • Delete A while it’s still dirty, forcing the kernel to free B and C twice.
2. Heap Manipulation:
   • Spray the kernel’s kmalloc-256 slab with controlled data (e.g., forged nft_table objects).
   • Leak kernel pointers by abusing the NFTA_TABLE_USERDATA attribute.
3. ROP Chain Execution:
   • Replace freed memory with a fake nft_expr object containing a ROP payload.
   • Hijack control flow via the ops->dump() function pointer, triggering a leave; ret gadget to pivot the stack.

// Example payload setup for stack migration
*(uint64_t *)&setelem_data[0x30] = kernel_off + 0xffffffff8112af10; // pop rdi; ret

Impact & Mitigation

Affected Systems: Linux kernels ≥5.4 (nftables support) prior to patched versions.
Risk: Local privilege escalation to root, bypassing security mechanisms like SELinux.

• Apply kernel updates from vendor repositories immediately.
• Restrict privileged user access where patching is delayed.
• Monitor for anomalous nftables configuration changes.

1. Patch Urgency: This exploit requires no user interaction, making it a prime target for attackers.
2. Defense Strategy: Enable kernel hardening features (e.g., CONFIG_SLAB_FREELIST_HARDENED) to complicate heap manipulation.
3. Detection: Audit logs for unusual nftables set deletions or rapid privilege escalations.

Linux maintainers have addressed the issue in kernel versions 6.1.45, 5.15.90, and 5.4.260. System administrators are urged to prioritize updates for critical infrastructure.

Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download