Bug 2161713 (CVE-2023-0179)

Summary:	CVE-2023-0179 kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dhoward, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rhandlin, rogbas, rvrbovsk, scweaver, security-response-team, sgrubb, tyberry, vkumar, walters, williams, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.10.164, kernel 5.15.89, kernel 6.1.7	Doc Type:	If docs needed, set a value
Doc Text:	A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-23 13:17:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2161722, 2161723, 2161724, 2161725, 2161726, 2161727, 2161728, 2161729, 2161730, 2161746, 2161747, 2170098
Bug Blocks:	2159917

Description Rohit Keshri 2023-01-17 17:10:45 UTC

An integer overflow vulnerability was found within the Netfilter (nftables) subsystem. The exploitation could allow the leakage of both stack and heap addresses and, potentially, a Local Privilege Escalation to the root user via arbitrary code execution.

Reference:
https://seclists.org/oss-sec/2023/q1/20

Comment 4 Rohit Keshri 2023-01-17 17:53:35 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2161722]

Comment 13 errata-xmlrpc 2023-02-28 08:18:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0951 https://access.redhat.com/errata/RHSA-2023:0951

Comment 14 errata-xmlrpc 2023-02-28 09:51:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0979 https://access.redhat.com/errata/RHSA-2023:0979

Comment 15 errata-xmlrpc 2023-02-28 11:42:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1008 https://access.redhat.com/errata/RHSA-2023:1008

Comment 16 errata-xmlrpc 2023-03-14 13:53:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202

Comment 17 errata-xmlrpc 2023-03-14 13:54:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1203 https://access.redhat.com/errata/RHSA-2023:1203

Comment 18 errata-xmlrpc 2023-03-23 09:03:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1435 https://access.redhat.com/errata/RHSA-2023:1435

Comment 19 Product Security DevOps Team 2023-03-23 13:17:46 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-0179