CVE-2024-44945

A flaw was found in the Linux kernel's netfilter nfnetlink component. A missing initialization of extended acknowledgement (extack) data during batch operations (BATCH_BEGIN and BATCH_END) could allow a local attacker to potentially disclose sensitive information from kernel memory or cause a system crash, leading to a denial of service. This vulnerability arises from the use of uninitialized data, which may contain remnants of previous memory contents.

Assessed metadata without initialization may not be in controlled by the attacker and hence this C and I should be limited exploitable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nfnetlink kernel module from loading. Create a file named /etc/modprobe.d/disable-nfnetlink.conf with the content install nfnetlink /bin/true. A system reboot is required for this change to take effect. Disabling this module may impact network filtering functionality that relies on nfnetlink.