CVE-2023-35001

Vulnerabilidad de Lectura/Escritura en nftables Fuera de los Límites del kernel de Linux; nft_byteorder administra incorrectamente los contenidos de registro de VM cuando CAP_NET_ADMIN está en cualquier espacio de nombres de usuario o red

An out-of-bounds (OOB) memory access flaw was found in the Netfilter module in the Linux kernel's nft_byteorder_eval in net/netfilter/nft_byteorder.c. A bound check failure allows a local attacker with CAP_NET_ADMIN access to cause a local privilege escalation issue due to incorrect data alignment.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the processing of nft chains. The issue results from incorrect pointer scaling, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

This update for the Linux Kernel 5.14.21-150400_24_46 fixes several issues. The following security issues were fixed. Fixed a use-after-free in Netfilter nf_tables when processing batch requests. Fixed a flaw in the networking subsystem within the handling of the RPL protocol. Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c. Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege. Fixed a type confusion in pick_next_rt_entity, that could cause memory corruption. Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. Fixed a heap out-of-bounds write in the ipvlan network driver.