CVE-2024-51440

CVE-2024-51440 is a privilege escalation vulnerability in Nothing Tech's Nothing OS version 2.6, specifically affecting the NtBpfService component. This flaw, linked to CWE-276 (Incorrect Default Permissions), has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

A local attacker with low privileges (PR:L) can exploit this vulnerability without user interaction (UI:N) and with low complexity (AC:L). Successful exploitation allows the attacker to escalate privileges, potentially gaining full control over the affected device by modifying or accessing restricted resources through the NtBpfService.

Mitigation details and further technical analysis are available in the referenced advisory at https://sharedobject.blog/posts/nothing-bpf/.