Linux_Exploit_CVE_2024_1086_fc4e57fd

rule Linux_Exploit_CVE_2024_1086_fc4e57fd {
    meta:
        author = "Elastic Security"
        id = "fc4e57fd-e830-461e-ad49-e6858e504b41"
        fingerprint = "c3873781bffb5d204131ad4ad138a3be7fa75905c31eab6f6422d62f55c1f94f"
        creation_date = "2024-03-26"
        last_modified = "2026-05-22"
        threat_name = "Linux.Exploit.CVE-2024-1086"
        reference_sample = "d8dd09b01eb4e363d88ff53c0aace04c39dbea822b7adba7a883970abbf72a77"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $s1 = "nftnl_chain_alloc"
        $s2 = "/proc/sys/kernel/modprobe"
        $s3 = "echo -n 1 1>/proc/%u/fd/%u"
        $s4 = "/proc/self/uid_map"
        $s5 = "/proc/self/setgroups"
        $s6 = "unshare(CLONE_NEWUSER)"
        $s7 = "unshare(CLONE_NEWNET)"
        $s8 = "/sbin/nft delete table ip filter"
        $s9 = "/proc/sys/net/ipv4/conf/%s/rp_filter"
        $fs1 = "confirmed double alloc PMD/PTE"
        $fs2 = "spraying %d pte's..."
        $fs3 = "verified modprobe_path/usermodehelper_path"
    condition:
        all of ($fs*) or all of ($s*)
}