Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations utilizing Windows Hyper-V or Linux Netfilter for NAT
Incident: Discovery of the NatJack attack class and associated CVEs allowing NAT table manipulation.
Impact: Attackers can hijack active TCP sessions and spoof DNS responses for systems behind the same NAT.
Attacker: Privileged internal attackers or compromised adjacent systems
Analysis: The NatJack attack class exploits a systemic assumption in NAT implementations that internal hosts will not manipulate each other’s connection states. By altering connection-tracking entries, an attacker with local privileged access can redirect active TCP traffic or intercept DNS responses. This vulnerability spans both Windows Hyper-V and Linux Netfilter implementations.
Recommendations: Apply the latest kernel updates for Linux and Windows Server/11 to patch known CVEs; Implement strict workload isolation to prevent untrusted systems from sharing NAT infrastructure; Enforce end-to-end encryption for all internal traffic to neutralize the impact of session hijacking
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source