CVE-2023-4004: Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A flaw in the Linux Kernel found. Improper element removal in function nftpipaporemove when insert an element without a NFTSETEXTKEYEND that can lead to use-after-free.
Reference: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/
Other sources
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nftpipaporemove function with the element, without a NFTSETEXTKEYEND. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
— Launchpad
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the nftpipaporemove function in the netfilter. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause the system to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.5 - Configuration
Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0; apply temporarily with sudo sysctl -w kernel.unprivileged_userns_clone=0 and persist the setting in /etc/sysctl.d/99-disable-unpriv-userns.conf.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4004?
CVE-2023-4004 has a high severity rating due to its potential to cause use-after-free vulnerabilities in the Linux Kernel.
How do I fix CVE-2023-4004?
To fix CVE-2023-4004, update the Linux Kernel to a version that includes the patch addressing this vulnerability.
Which systems are affected by CVE-2023-4004?
CVE-2023-4004 affects various systems including IBM Storage Protect Plus vSnap, Red Hat Enterprise Linux, and several versions of the Linux Kernel.
Can CVE-2023-4004 lead to data loss?
Yes, CVE-2023-4004 can lead to data loss as it can result in memory corruption due to use-after-free errors.
What is the recommended action for servers running Linux Kernel version 6.5 or lower for CVE-2023-4004?
It is recommended to upgrade to a patched version of the Linux Kernel to mitigate the risks associated with CVE-2023-4004.