CVE-2023-1095: Null Pointer Dereference
In nftablesupdtable, if nftablestableenable returns an error, nfttransdestroy is called to free the transaction object. nfttransdestroy() calls listdel(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.0 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 580077855a40741cf511766129702d97ff02f4d9
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1095?
CVE-2023-1095 has been classified as a high severity vulnerability due to the potential for NULL pointer dereference leading to denial of service.
How do I fix CVE-2023-1095?
To mitigate CVE-2023-1095, update to the recommended fixed kernel versions provided by your distribution, such as Red Hat or Debian.
What software is affected by CVE-2023-1095?
CVE-2023-1095 affects various kernel versions in Linux distributions such as Red Hat Enterprise Linux 8.0 and 9.0 and certain Debian kernel packages.
What is the cause of CVE-2023-1095?
CVE-2023-1095 is caused by an error in nf_tables_updtable leading to nft_trans_destroy calling list_del() on a transaction object not correctly placed on a list.
Can CVE-2023-1095 be exploited remotely?
Yes, CVE-2023-1095 may be exploited remotely if the affected system is configured to process nf_tables transactions that trigger the vulnerability.