● CVE-2024-1086 / Netfilter Zero-Day

CVE-2024-1086: Linux Netfilter nf_tables Double Free Teardown

How an improper verdict handling bug in net/netfilter/nf_tables_api.c caused double reference drops on network packets, enabling container root breakouts.

💡 Penjelasan Bahasa Sederhana (ELI5)

Think of a ticket inspector on a train. A passenger hands over a ticket. The first inspector punches the ticket and marks it as used. Then, because the passenger sneezes, an unhandled rule causes a second inspector to grab the exact same ticket and punch it again. In Linux networking, dropping a packet twice freed its memory twice, allowing malicious code to masquerade as the train conductor.

Konsep Inti dan Istilah Subsistem

Netfilter / nf_tables: The Linux kernel's modern packet filtering, network address translation (NAT), and packet mangling framework.
NF_DROP Verdict: A netfilter rule evaluation outcome instructing the kernel to drop and deallocate the incoming network packet (`sk_buff`).
sk_buff (Socket Buffer): The core kernel data structure representing every network packet traveling through the Linux networking stack.
User Namespaces (unshare): A Linux security isolation feature allowing unprivileged users to obtain root inside a sandbox, commonly abused to access nf_tables.

Mekanisme Serangan Langkah demi Langkah

Step 1

1. Namespace Creation

An unprivileged user creates an isolated network namespace via unshare(CLONE_NEWUSER | CLONE_NEWNET).

Step 2

2. Injecting Malformed Rule

The attacker loads a custom nftables rule returning a negative verdict code mismanaged by the hook pipeline.

Step 3

3. Triggering Double Free

The packet processing engine drops the sk_buff, but the error return path drops the exact same packet a second time.

Step 4

4. Spraying Heap Allocations

The attacker sprays fake Page Middle Directory (PMD) entries into the freed memory, achieving full arbitrary physical memory write.

Kode Sumber: Celah Fatal vs. Perbaikan Aman

Disajikan dalam bahasa pemrograman tingkat tinggi yang mudah dibaca (tanpa assembly rumit).

CELAH BELUM DITAMBAL

// VULNERABLE: net/netfilter/nf_tables_api.c before patch
static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, ...) {
    // ROOT CAUSE:
    // If verdict evaluation returns an invalid negative integer,
    // the evaluation loop treats it as both NF_DROP and an internal error!
    if (verdict < 0) {
        kfree_skb(skb); // First free of socket buffer!
        return verdict; // Calling hook also invokes kfree_skb(), triggering DOUBLE FREE!
    }
    return 0;
}

PATCH YANG DIPERKUAT

// SECURE: net/netfilter/nf_tables_api.c patch
static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, ...) {
    // 1. Strict verdict assertion
    if (verdict < 0) {
        // Clear ownership flags to guarantee only one caller deallocates skb
        nf_tables_rule_destroy(rule);
        
        // Let the upper caller handle the single, orderly drop:
        return -EINVAL; 
    }
    return 0;
}

Daftar Periksa Rekayasa & Pengerasan Sistem

Ensure packet drop verdicts are handled by exactly one layer in the Netfilter evaluation chain.
Never invoke explicit `kfree_skb()` inside an error path that subsequently propagates an error code to a caller that also frees the packet.
Restrict unprivileged user namespace creation (`sysctl -w kernel.unprivileged_userns_clone=0`) on hardened servers.
Audit custom verdict handling logic with static analysis tools like Smatch and Coccinelle.

← Jelajahi Direktori Keamanan Lengkap Semua Pembaruan Keamanan →