CVE-2024-42109: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42109 affects the Linux kernel's netfilter subsystem, specifically the nf_tables component. The vulnerability was discovered in July 2024 and affects multiple versions of the Linux kernel including 5.15.129-5.15.163, 6.1.50-6.1.98, 6.5-6.6.39, and 6.7-6.9.9. The issue involves a use-after-free vulnerability in the nf_tables component when handling table deletions (NVD).

The vulnerability stems from a conditional flush operation in the netlink notifier that doesn't properly handle cases where a table-to-be-removed might still be referenced by transactions being processed by the worker. This leads to a use-after-free condition, specifically in nft_ctx_update (nf_tables.h:1831), nft_commit_release (nf_tables_api.c:9530), and nf_tables_trans_destroy_work (nf_tables_api.c:9597). The issue was exposed after the implementation of commit e169285f8c56 which made an unconditional fetch of table->family. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Kernel Patch).

The vulnerability can lead to a denial of service condition through system crashes. When exploited, it allows a local attacker with appropriate privileges to potentially cause system instability through use-after-free memory corruption (NVD).

The vulnerability requires local access and low privileges to exploit. It has been confirmed to be exploitable through the netfilter subsystem's table management operations, specifically when handling table deletions. The issue was discovered and reported by syzbot, indicating it was found through automated testing (Kernel Patch).

The vulnerability has been patched in the Linux kernel by modifying the nf_tables component to unconditionally flush pending work before the notifier is called. The fix involves removing the conditional check for empty destroy lists and always performing the flush operation. System administrators should update to patched kernel versions: beyond 5.15.163, 6.1.98, 6.6.39, or 6.9.9 depending on their kernel branch (NVD).