CVE-2023-3610: Use-after-free in Linux kernel's netfilter: nf_tables component
First published: Fri Jul 21 2023(Updated: )
A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. Reference: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=4bedf9eee016286c835e3d8fa981ddece5338795">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=4bedf9eee016286c835e3d8fa981ddece5338795</a>
Credit: cve-coordination@google.com cve-coordination@google.com cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <0:5.14.0-284.30.1.el9_2 | 0:5.14.0-284.30.1.el9_2 |
| redhat/kernel-rt | <0:5.14.0-284.30.1.rt14.315.el9_2 | 0:5.14.0-284.30.1.rt14.315.el9_2 |
| Linux Linux kernel | >=5.9<6.4 | |
| Linux Linux kernel | =6.4-rc1 | |
| Linux Linux kernel | =6.4-rc2 | |
| Linux Linux kernel | =6.4-rc3 | |
| Linux Linux kernel | =6.4-rc4 | |
| Linux Linux kernel | =6.4-rc5 | |
| Linux Linux kernel | =6.4-rc6 | |
| Linux Linux kernel | =6.4-rc7 | |
| Debian Debian Linux | =11.0 | |
| Linux Linux kernel | >=5.9<5.10.188 | |
| Linux Linux kernel | >=5.11<5.15.119 | |
| Linux Linux kernel | >=5.16<6.1.36 | |
| Linux Linux kernel | >=6.2<6.3.10 | |
| Debian Debian Linux | =10.0 | |
| redhat/Kernel | <6.4 | 6.4 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.6-1 6.12.9-1 |
Remedy
In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.
Remedy
If not needed, disable the ability for unprivileged users to create namespaces. To do this temporarily, do: sudo sysctl -w kernel.unprivileged_userns_clone=0 To disable across reboots, do: echo kernel.unprivileged_userns_clone=0 | \ sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://kernel.dance/4bedf9eee016286c835e3d8fa981ddece5338795
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=4bedf9eee016286c835e3d8fa981ddece5338795
- https://www.cve.org/CVERecord?id=CVE-2023-3610 https://nvd.nist.gov/vuln/detail/CVE-2023-3610 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=4bedf9eee016286c835e3d8fa981ddece5338795
- https://bugzilla.redhat.com/show_bug.cgi?id=2225198
- https://access.redhat.com/errata/RHSA-2023:5069
- https://access.redhat.com/errata/RHSA-2023:5091
- https://access.redhat.com/errata/RHSA-2023:5093
- https://access.redhat.com/security/cve/CVE-2023-3610
- https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
- https://security.netapp.com/advisory/ntap-20230818-0005/
- https://www.debian.org/security/2023/dsa-5461
- https://launchpad.net/bugs/cve/CVE-2023-3610
- https://access.redhat.com/security/cve/CVE-2023-3390
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2213260
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2213271
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216160
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216159
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2225198#c7
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3610
- https://nvd.nist.gov/vuln/detail/CVE-2023-3610
- https://security-tracker.debian.org/tracker/CVE-2023-3610
- https://ubuntu.com/security/CVE-2023-3610
- https://git.kernel.org/linus/4bedf9eee016286c835e3d8fa981ddece5338795
Parent vulnerabilities
(Appears in the following advisories)
- collector/nvd-latest
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- agent/weakness
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-3610
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- collector/security-tracker-debian
- source/Debian
- agent/remedy
- agent/softwarecombine
- agent/references
- agent/description
- agent/tags
- agent/event
- agent/last-modified-date
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.9
- version/linux linux kernel/6.4-rc1
- version/linux linux kernel/6.4-rc2
- version/linux linux kernel/6.4-rc3
- version/linux linux kernel/6.4-rc4
- version/linux linux kernel/6.4-rc5
- version/linux linux kernel/6.4-rc6
- version/linux linux kernel/6.4-rc7
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- version/linux linux kernel/5.11
- version/linux linux kernel/5.16
- version/linux linux kernel/6.2
- version/debian debian linux/10.0
- package-manager/debian