CVE-2023-4015: Use-after-free in Linux kernel's netfilter: nf_tables component

Q: What is the severity of CVE-2023-4015?

The severity of CVE-2023-4015 is relatively high due to its potential for local privilege escalation.

Q: How do I fix CVE-2023-4015?

To fix CVE-2023-4015, update the Linux kernel to version 6.5 or apply the necessary patches as specified by your distribution.

Q: Which systems are affected by CVE-2023-4015?

CVE-2023-4015 affects various versions of the Linux kernel, specifically from 5.9 to 6.5, and certain Debian Linux versions.

Q: What type of vulnerability is CVE-2023-4015?

CVE-2023-4015 is classified as a use-after-free vulnerability in the netfilter nf_tables component.

Q: Can CVE-2023-4015 be exploited remotely?

CVE-2023-4015 is primarily a local privilege escalation vulnerability and cannot be exploited remotely.

Published Sep 6, 2023

Updated

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nftimmediatedeactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

Affected Software

8 affected componentsFixes available

Linux Linux kernel>=5.9<5.10.190

Linux Linux kernel>=5.11<5.15.124

Linux Linux kernel>=5.16<6.1.43

Linux Linux kernel>=6.2<6.4.8

Debian Debian Linux=12.0

Linux Linux kernel<=6.5

redhat/kernel<6.5

6.5

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/Kernel to a version that resolves this vulnerability.
Fixed in 6.5
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade Linux kernel netfilter nf_tables to a version that resolves this vulnerability.
Patch 0a771f7b266b02d262900c75f1e175c7fe76fec2
Configuration
If unprivileged users do not need to create namespaces, set kernel.unprivileged_userns_clone=0; apply temporarily with sysctl and persist across reboots in /etc/sysctl.d/99-disable-unpriv-userns.conf.
Linux kernel kernel.unprivileged_userns_clone = 0

Event History

Sep 6, 2023

CVE Published

via MITRE·01:52 PM

Data Sourced

via MITRE·01:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·05:37 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5492

Frequently Asked Questions

What is the severity of CVE-2023-4015?

The severity of CVE-2023-4015 is relatively high due to its potential for local privilege escalation.

How do I fix CVE-2023-4015?

To fix CVE-2023-4015, update the Linux kernel to version 6.5 or apply the necessary patches as specified by your distribution.

Which systems are affected by CVE-2023-4015?

CVE-2023-4015 affects various versions of the Linux kernel, specifically from 5.9 to 6.5, and certain Debian Linux versions.

What type of vulnerability is CVE-2023-4015?

CVE-2023-4015 is classified as a use-after-free vulnerability in the netfilter nf_tables component.

Can CVE-2023-4015 be exploited remotely?

CVE-2023-4015 is primarily a local privilege escalation vulnerability and cannot be exploited remotely.

CVE-2023-4015: Use-after-free in Linux kernel's netfilter: nf_tables component

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2023-4015?

How do I fix CVE-2023-4015?

Which systems are affected by CVE-2023-4015?

What type of vulnerability is CVE-2023-4015?

Can CVE-2023-4015 be exploited remotely?

Company

Resources

Contact