First published: Tue Feb 28 2023(Updated: )
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel | <6.0 | 6.0 |
Linux kernel | <6.0 | |
Red Hat Enterprise Linux | =8.0 | |
Red Hat Enterprise Linux | =9.0 | |
debian/linux | 5.10.223-1 5.10.234-1 6.1.123-1 6.1.128-1 6.12.17-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-1095 has been classified as a high severity vulnerability due to the potential for NULL pointer dereference leading to denial of service.
To mitigate CVE-2023-1095, update to the recommended fixed kernel versions provided by your distribution, such as Red Hat or Debian.
CVE-2023-1095 affects various kernel versions in Linux distributions such as Red Hat Enterprise Linux 8.0 and 9.0 and certain Debian kernel packages.
CVE-2023-1095 is caused by an error in nf_tables_updtable leading to nft_trans_destroy calling list_del() on a transaction object not correctly placed on a list.
Yes, CVE-2023-1095 may be exploited remotely if the affected system is configured to process nf_tables transactions that trigger the vulnerability.