Bug 2220892 (CVE-2023-35001, ZDI-CAN-20721)

Summary:	CVE-2023-35001 kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, fwestpha, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jkastnin, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rhandlin, rkeshri, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, swood, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds (OOB) memory access flaw was found in the Netfilter module in the Linux kernel's nft_byteorder_eval in net/netfilter/nft_byteorder.c. A bound check failure allows a local attacker with CAP_NET_ADMIN access to cause a local privilege escalation issue due to incorrect data alignment.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2221046, 2221047, 2221717, 2221718, 2221719, 2221720, 2221721, 2221722, 2221723, 2221724, 2221725, 2221726, 2221727, 2221729, 2221730, 2221731, 2221732, 2221733, 2221734, 2221735, 2221736, 2221737, 2221746, 2221747, 2221748, 2221749, 2221750, 2221751, 2221752, 2221753, 2221754, 2221755, 2221756, 2221744, 2221745, 2221759
Bug Blocks:	2220897

Description TEJ RATHI 2023-07-06 13:01:31 UTC

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

https://lore.kernel.org/netfilter-devel/20230705121515.747251-1-cascardo@canonical.com/T/
https://www.openwall.com/lists/oss-security/2023/07/05/3

Comment 9 Rohit Keshri 2023-07-10 17:01:39 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2221759]