CVE-2023-4004

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Se encontró una falla de use-after-free en el netfilter del kernel de Linux en la forma en que un usuario activa la función nft_pipapo_remove con el elemento, sin un NFT_SET_EXT_KEY_END. Este problema podría permitir que un usuario local bloquee el sistema o potencialmente aumente sus privilegios en el sistema.

*Credits: N/A

CVSS Scores

NISTv3.1 7.8

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-07-30 CVE Reserved
2023-07-31 CVE Published
2024-09-14 EPSS Updated
2024-11-15 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free

CAPEC

References (26)

URL	Tag	Source
http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html	Third Party Advisory
http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html	Third Party Advisory
https://security.netapp.com/advisory/ntap-20231027-0001	Third Party Advisory
https://www.debian.org/security/2023/dsa-5480	Third Party Advisory
https://www.debian.org/security/2023/dsa-5492	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de	2023-12-29

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2023:4961	2023-12-29
https://access.redhat.com/errata/RHSA-2023:4962	2023-12-29
https://access.redhat.com/errata/RHSA-2023:4967	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5069	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5091	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5093	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5221	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5244	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5255	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5548	2023-12-29
https://access.redhat.com/errata/RHSA-2023:5627	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7382	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7389	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7411	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7417	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7431	2023-12-29
https://access.redhat.com/errata/RHSA-2023:7434	2023-12-29
https://access.redhat.com/security/cve/CVE-2023-4004	2023-11-21
https://bugzilla.redhat.com/show_bug.cgi?id=2225275	2023-11-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.6 < 5.10.188 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.6 < 5.10.188"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.11 < 5.15.123 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.11 < 5.15.123"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.16 < 6.1.42 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.16 < 6.1.42"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.2 < 6.4.7 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.2 < 6.4.7"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				38 Search vendor "Fedoraproject" for product "Fedora" and version "38"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				9.0 Search vendor "Redhat" for product "Enterprise Linux" and version "9.0"		-		Affected
Netapp Search vendor "Netapp"		H300s Search vendor "Netapp" for product "H300s"				-		-		Affected
Netapp Search vendor "Netapp"		H410s Search vendor "Netapp" for product "H410s"				-		-		Affected
Netapp Search vendor "Netapp"		H500s Search vendor "Netapp" for product "H500s"				-		-		Affected
Netapp Search vendor "Netapp"		H700s Search vendor "Netapp" for product "H700s"				-		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0"		-		Affected