The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added three high-severity Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing a definitive directive for urgent remediation. While the binding compliance deadline targets U.S. federal agencies, the confirmed active exploitation of these flaws makes immediate patching a critical priority for any organization running Linux infrastructure.
The specific flaws now cataloged are CVE-2024-1086, CVE-2023-35001, and CVE-2022-34918. As reported by Security Affairs, all three are use-after-free vulnerabilities residing in the kernel's nftables subsystem, a core component used for packet filtering and network address translation.
Inclusion in the KEV list indicates these vulnerabilities are being actively exploited in real-world attacks, not merely theoretical risks. CISA's directive mandates remediation by set deadlines for federal entities, but the technical implications extend universally. A successful exploit can allow an attacker to escape containerized environments like Docker or Kubernetes, compromising the host system and bypassing standard isolation controls.
For any organization running a modern Linux distribution that uses the nftables framework, this update demands immediate action.
Essential Remediation Playbook:
- Inventory Affected Systems: Immediately identify all Linux systems (on-premise servers, VMs, cloud instances) running kernel versions vulnerable to these CVEs.
- Apply Vendor Patches: Prioritize deploying security updates from your Linux distribution vendor (e.g., Red Hat, Ubuntu, Debian, SUSE). These updates contain the critical kernel fixes.
- Rebuild Container Images: A crucial, often-missed step. Audit and update the base images for all containers. A container running on a patched host but using a vulnerable base image kernel remains at risk. All running containers must be rebuilt with updated images.
- Verify and Monitor: Confirm the patched kernel version is active post-update (using
uname -r) and enhance monitoring for indicators of kernel-level compromise.
The recurrence of critical flaws in the complex nftables subsystem over multiple years signals a systemic risk area within kernel security. CISA's action provides concrete, evidence-based justification to enforce accelerated patch cycles and allocate necessary resources across all affected environments. With active exploitation confirmed, delaying these critical patches is not a viable risk-management strategy.
美國網絡安全和基礎設施安全局（CISA）已正式將三個高嚴重程度的Linux核心漏洞納入其已知被利用漏洞（KEV）目錄，並發出明確指令要求緊急補救。儘管具約束力的合規期限針對美國聯邦機構，但這些漏洞已被證實存在實際利用活動，使得對任何運行Linux基礎設施的組織而言，立即進行補丁更新成為一項關鍵優先事項。
現已被列入目錄的具體漏洞為CVE-2024-1086、CVE-2023-35001及CVE-2022-34918。據Security Affairs報導，這三者均為核心nftables子系統中的釋放後使用漏洞，該子系統是用於封包過濾及網絡地址轉換的核心組件。
被列入KEV名單表明，這些漏洞正於現實攻擊中被主動利用，而非僅是理論上的風險。CISA的指令要求聯邦實體在指定期限內進行補救，但其技術影響具有普遍性。成功的漏洞利用可允許攻擊者逃逸Docker或Kubernetes等容器化環境，從而危及主機系統並繞過標準隔離控制。
對於任何使用nftables框架作為預設封包過濾器的現代Linux發行版系統，此更新要求立即採取行動。
關鍵補救步驟手冊：
- 盤點受影響系統：立即識別所有運行易受這些CVE攻擊的核心版本之Linux系統（本地伺服器、虛擬機、雲實例）。
- 套用供應商補丁：優先部署來自Linux發行版供應商（例如Red Hat、Ubuntu、Debian、SUSE）的安全更新。這些更新包含關鍵的核心修復。
- 重新建構容器映像：一個關鍵且常被忽視的步驟。審核並更新所有容器的基礎映像。在已修補的主機上運行但使用易受攻擊基礎映像核心的容器仍存在風險。所有運行中的容器必須使用更新後的映像重新建構。
- 驗證與監控：確認更新後核心版本已啟用（使用
uname -r），並加強對核心級別妥協指標的監控。
複雜的nftables子系統在多年間反覆出現關鍵漏洞，這標誌著核心安全中的一個系統性風險領域。CISA的行動提供了具體、基於證據的理由，以在所有受影響環境中強制實施加速的補丁週期並分配必要資源。鑑於實際利用已被證實，延遲這些關鍵補丁並非可行的風險管理策略。