CISA Alerts on Linux Kernel Vulnerability Exploited in Ransomware Attacks

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a critical Linux kernel vulnerability is being exploited in ransomware campaigns against organisations worldwide. The flaw, tracked as CVE-2024-1086, affects the netfilter: nf_tables component and is a use-after-free vulnerability that can enable local privilege escalation to gain root access.

CISA notes that threat actors are actively leveraging this weakness after initial access, which can allow them to disable security controls, encrypt files across multiple systems, and demand ransom payments. The vulnerability is categorised under CWE-416 and is deemed highly dangerous because it can bypass protections and facilitate privilege escalation from a standard user to administrator.

Mitigations advised by CISA emphasise applying vendor-provided mitigations or discontinuing use of the product where mitigations are unavailable, with organisations urged to update to the latest kernel releases from their distribution vendors. The KEV catalogue inclusion underscores the need for prioritised remediation, and security teams are advised to monitor for signs of exploitation, review logs for unusual privilege escalations, and ensure patched Linux kernel installations across enterprise environments.