CVE-2023-3777: Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.
When nftablesdelrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.
We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8 - Configuration
Disable unprivileged users from creating namespaces by setting kernel.unprivileged_userns_clone=0; apply temporarily with `sudo sysctl -w kernel.unprivileged_userns_clone=0` and persist across reboots in /etc/sysctl.d/99-disable-unpriv-userns.conf.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3777?
CVE-2023-3777 is classified as a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2023-3777?
To mitigate CVE-2023-3777, update the kernel to a version higher than 6.5 or apply the latest patches provided by your distribution.
What systems are affected by CVE-2023-3777?
CVE-2023-3777 affects multiple versions of the Linux kernel, specifically versions between 5.9 and 6.5, including various distributions such as Debian and Ubuntu.
Can CVE-2023-3777 be exploited remotely?
CVE-2023-3777 is a local privilege escalation vulnerability and cannot be exploited remotely, requiring local access to the affected system.
What components of the Linux kernel does CVE-2023-3777 involve?
CVE-2023-3777 involves a use-after-free vulnerability in the Linux kernel's netfilter component, specifically in the nf_tables functionality.