CVE-2024-1086 ('Dirty Frag'): Linux Kernel nf_tables Privilege Escalation — Detection and Hardening

---
title: Potential Linux Kernel Privilege Escalation via nftables (CVE-2024-1086)
id: 8a4b3c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of the 'nft' binary by non-root users, which is indicative of nf_tables manipulation often used in CVE-2024-1086 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-1086
author: Security Arsenal
date: 2024/04/01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/nft'
    UserName|endswith:
      - 'nobody'
      - 'ubuntu'
      - 'www-data'
      - 'user'
  filter_main_root:
    UserName|notcontains: 'root'
falsepositives:
  - Administrative scripts run by users (rare)
level: high
---
title: Linux Kernel Exploit Preparation - User Namespace Creation
id: 9b5c2d1e-6f0a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the creation of new user namespaces using 'unshare', a common technique to gain the capabilities required to exploit CVE-2024-1086.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2024/04/01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/unshare'
    CommandLine|contains:
      - '-U'
      - '--user'
      '-C'
      '--mount'
falsepositives:
  - Legitimate use of user namespaces by container runtimes (docker, podman)
  - Developer testing environments
level: medium

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("nft", "unshare", "warpx")
| extend ProcessUser = AccountName
| where ProcessUser != "root"
| where InitiatingProcessFileName !in~ ("docker", "podman", "runc", "systemd")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by Timestamp desc

-- Hunt for nft execution by non-root users
SELECT Pid, Name, CommandLine, Username, Exe
FROM pslist()
WHERE Name = 'nft'
  AND Username != 'root'

-- Hunt for recently created executable files in /tmp or /dev/shm (common exploit drop locations)
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs=["/tmp/*", "/dev/shm/*"])
WHERE Mode =~ '^.*x.*'
  AND Mtime > now() - 1h

#!/bin/bash

# Remediation Script for CVE-2024-1086 (Dirty Frag)
# Author: Security Arsenal

CVE="CVE-2024-1086"

echo "[+] Checking vulnerability status for $CVE..."

# Get current kernel version
KERNEL_VERSION=$(uname -r | cut -d'-' -f1)
echo "[+] Current Kernel Version: $KERNEL_VERSION"

# Function to compare versions
version_less_than() {
    if [[ $1 == $2 ]]; then
        return 1
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    for ((i=${#ver1[@]}; i<${#ver2[@]}; i++)); do
        ver1[i]=0
    done
    for ((i=0; i<${#ver1[@]}; i++)); do
        if [[ -z ${ver2[i]} ]]; then
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]})); then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]})); then
            return 0
        fi
    done
    return 1
}

# Check against fixed versions (simplified logic for major branches)
VULNERABLE=false

# Logic based on mainline fixed versions: 6.1.76, 6.6.16, 6.7.4
# Note: Distributions backport patches, so version check is heuristic only.
if version_less_than $KERNEL_VERSION "6.1.76"; then
    # Check if kernel is 6.1.x or older
    if [[ $KERNEL_VERSION == 6.1.* ]]; then
        VULNERABLE=true
    fi
fi

if version_less_than $KERNEL_VERSION "6.6.16"; then
    if [[ $KERNEL_VERSION == 6.6.* ]]; then
        VULNERABLE=true
    fi
fi

if [[ $KERNEL_VERSION < "6.1" ]]; then
    # Kernels older than 6.1.76 (even 5.x) are generally considered vulnerable until patched by distro
    # We assume older LTS (5.15, 5.4) are vulnerable unless distro specifically patched.
    echo "[!] Warning: Kernel is older than 6.1. Check with your distribution vendor for backport status."
    VULNERABLE=true
fi

if [ "$VULNERABLE" = true ]; then
    echo "[!!!] System POTENTIALLY VULNERABLE to $CVE."
    echo "[!!!] Action Required: Update kernel immediately."
    echo "    e.g., 'apt-get install linux-image-generic' or 'yum update kernel'"
    
    # Check mitigation: User namespaces
    if [ -f /proc/sys/user/max_user_namespaces ]; then
        MAX_NS=$(cat /proc/sys/user/max_user_namespaces)
        if [ "$MAX_NS" -eq "0" ]; then
            echo "[+] Mitigation Active: User namespaces are disabled (user.max_user_namespaces = 0)."
        else
            echo "[!] Mitigation Opportunity: Consider disabling unprivileged user namespaces to hinder exploit reliability."
            echo "    Command: sysctl -w user.max_user_namespaces=0"
        fi
    fi
else
    echo "[+] Kernel version appears safe (based on heuristic)."
fi

echo "[+] Review loaded nf_tables modules:"
lsmod | grep nf_tables

Update the Linux kernel to the latest version provided by your distribution vendor immediately. Rebooting is required to load the new kernel.