CVE-2023-3776: Use-after-free in Linux kernel's net/sched: cls_fw component
A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation. If tcfchangeindev() fails, fwsetparms() will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=0323bce598eea038714f941ce2b22541c46d488f
Other sources
A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation.
If tcfchangeindev() fails, fwsetparms() will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5 Traffix Systems Signaling Delivery Controllerto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.5 - Upgrade
Upgrade
Linux kernel (net/sched: cls_fw)to a version that resolves this vulnerability.Fixed in past commit 0323bce598eea038714f941ce2b22541c46d488f - Configuration
Disable creation of user namespaces for unprivileged users by setting kernel.unprivileged_userns_clone=0 (both temporarily with: sysctl -w kernel.unprivileged_userns_clone=0 and persistently by writing kernel.unprivileged_userns_clone=0 to /etc/sysctl.d/99-disable-unpriv-userns.conf).
Linux kernel sysctl kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3776?
CVE-2023-3776 is considered a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2023-3776?
To fix CVE-2023-3776, upgrade the Linux kernel to version 6.5 or apply the relevant patches provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2023-3776?
CVE-2023-3776 affects Linux kernel versions prior to 6.5, including multiple versions in the 4.x and 5.x series.
Can CVE-2023-3776 be exploited remotely?
CVE-2023-3776 is a local privilege escalation vulnerability and cannot be exploited remotely.
What components of the Linux kernel are impacted by CVE-2023-3776?
CVE-2023-3776 impacts the net/sched: cls_fw component of the Linux kernel.