CVE-2024-42070 – This CVE is a memory leak vulnerability in the ... (How to Fix)

Q: What is the severity of CVE-2024-42070?

CVE-2024-42070 has a CVSS score of 5.5 (MEDIUM). This CVE is a memory leak vulnerability in the Linux kernel's netfilter nf_tables subsystem. It allows unprivileged local users to leak kernel memory pointers through chain objects, potentially enabling information disclosure or facilitating other attacks. Systems running vulnerable Linux kernel versions with nf_tables enabled are affected.

📋 TL;DR

This CVE is a memory leak vulnerability in the Linux kernel's netfilter nf_tables subsystem. It allows unprivileged local users to leak kernel memory pointers through chain objects, potentially enabling information disclosure or facilitating other attacks. Systems running vulnerable Linux kernel versions with nf_tables enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not explicitly stated in CVE, but patches are available in stable kernel trees. Likely affects versions before the fix commits.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if nf_tables subsystem is enabled and in use. Many distributions don't enable nf_tables by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Information disclosure of kernel memory addresses could enable attackers to bypass kernel address space layout randomization (KASLR) and facilitate more severe kernel exploits.

🟠

Likely Case

Local information disclosure of kernel pointers, potentially aiding in privilege escalation attacks when combined with other vulnerabilities.

🟢

If Mitigated

Minimal impact with proper kernel hardening and security modules enabled.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring local access to exploit.

🏢 Internal Only: MEDIUM - Internal users with local access could exploit this to gather information for privilege escalation attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of nf_tables operations. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in stable kernel commits: 23752737c6a6, 40188a25a984, 41a6375d48de, 461302e07f49, 5d43d789b579

Vendor Advisory: https://git.kernel.org/stable/c/23752737c6a618e994f9a310ec2568881a6b49c4

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for specific kernel package updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable nf_tables

linux

Disable the nf_tables subsystem if not required

modprobe -r nf_tables
echo 'blacklist nf_tables' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict local user access to systems where nf_tables is enabled
Implement strict privilege separation and monitor for suspicious nf_tables operations

🔍 How to Verify

Check if Vulnerable:

Check if nf_tables module is loaded: lsmod | grep nf_tables. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or is newer than the patched versions. Check with: uname -r

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing nf_tables operations from unprivileged users
System logs showing failed privilege escalation attempts

Network Indicators:

No network indicators - local vulnerability only

SIEM Query:

Process monitoring for nf_tables operations from non-root users

📊 Metadata

CVE ID: CVE-2024-42070

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: July 29, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42070, you might also want to check these: