CVE-2024-50257

A flaw was found in the netfilter component of the Linux kernel. This vulnerability, a use-after-free (UAF), occurs when the ip6table_nat module is unloaded concurrently with a call to the get_info() function. This race condition can allow a local attacker to cause a system crash, leading to a denial of service, or potentially execute arbitrary code with elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip6table_nat kernel module from loading. This can be achieved by creating a modprobe configuration file:

echo "blacklist ip6table_nat" > /etc/modprobe.d/disable-ip6table_nat.conf

A system reboot is required for this change to take effect. This mitigation may impact systems that rely on IPv6 Network Address Translation functionality.