CVE-2023-42756: Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSETCMDADD and IPSETCMDSWAP can lead to a kernel panic due to the invocation of ipsetput on a wrong set. This issue may allow a local user to crash the system.
Other sources
A flaw was found under netfilter subsystem. Race between IPSETCMDADD and IPSETCMDSWAP. No lock is hold when it does the condresched(). As a result, ipsetreflock (in thread 2) can swap the set with another when thread 1 is doing the condresched(). Which might lead to a local Denial of Service (DoS).
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a race condition between IPSETCMDADD and IPSETCMDSWAP in netfilter/ipset. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42756?
CVE-2023-42756 has the potential to cause a kernel panic, indicating a high severity due to its impact on system stability.
How do I fix CVE-2023-42756?
To mitigate CVE-2023-42756, upgrade to kernel version 6.6 or apply the necessary patches provided by your distribution.
What systems are affected by CVE-2023-42756?
CVE-2023-42756 affects various Linux distributions, including versions of the Linux kernel prior to 6.6.
Can CVE-2023-42756 be exploited remotely?
No, CVE-2023-42756 is a local vulnerability that requires a user with local access to exploit it.
What is the nature of the issue in CVE-2023-42756?
CVE-2023-42756 is caused by a race condition in the Netfilter subsystem that can lead to a kernel panic.