Bug 2225097 (CVE-2023-3776)

Summary:	CVE-2023-3776 kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint-bot, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, qzhao, rhandlin, rkeshri, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Kernel 6.5-rc2	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in fw_set_parms in net/sched/cls_fw.c in network scheduler sub-component in the Linux Kernel. This issue occurs due to a missing sanity check during cleanup at the time of failure, leading to a misleading reference. This may allow a local attacker to gain local privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2225102, 2225103, 2225636, 2225637, 2225638, 2225639, 2225640, 2225641, 2225642, 2225643, 2225644, 2225645, 2225646, 2225647, 2225648, 2225649, 2225650, 2225651, 2225652, 2225653, 2225654, 2225655, 2225656, 2225657, 2225658, 2225659, 2225660, 2225661, 2225662, 2225663, 2225664, 2225665, 2226640
Bug Blocks:	2225092

Description Alex 2023-07-24 10:19:36 UTC

A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=0323bce598eea038714f941ce2b22541c46d488f

Comment 11 errata-xmlrpc 2023-09-12 09:50:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5091 https://access.redhat.com/errata/RHSA-2023:5091

Comment 12 errata-xmlrpc 2023-09-12 09:52:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5093 https://access.redhat.com/errata/RHSA-2023:5093

Comment 13 errata-xmlrpc 2023-09-12 10:14:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5069 https://access.redhat.com/errata/RHSA-2023:5069

Comment 14 errata-xmlrpc 2023-09-19 08:00:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5221 https://access.redhat.com/errata/RHSA-2023:5221

Comment 15 errata-xmlrpc 2023-09-19 14:02:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5255 https://access.redhat.com/errata/RHSA-2023:5255

Comment 16 errata-xmlrpc 2023-09-19 14:35:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5244 https://access.redhat.com/errata/RHSA-2023:5244

Comment 17 errata-xmlrpc 2023-10-10 16:24:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:5628 https://access.redhat.com/errata/RHSA-2023:5628

Comment 18 errata-xmlrpc 2023-10-17 09:24:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2023:5775 https://access.redhat.com/errata/RHSA-2023:5775

Comment 19 errata-xmlrpc 2023-10-17 15:06:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:5794 https://access.redhat.com/errata/RHSA-2023:5794

Comment 20 errata-xmlrpc 2023-11-08 08:39:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:6799 https://access.redhat.com/errata/RHSA-2023:6799

Comment 21 errata-xmlrpc 2023-11-08 10:57:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:6813 https://access.redhat.com/errata/RHSA-2023:6813

Comment 22 errata-xmlrpc 2023-11-15 19:39:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support

Via RHSA-2023:7294 https://access.redhat.com/errata/RHSA-2023:7294

Comment 23 errata-xmlrpc 2023-11-21 11:12:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:7389 https://access.redhat.com/errata/RHSA-2023:7389

Comment 24 errata-xmlrpc 2023-11-21 11:15:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:7382 https://access.redhat.com/errata/RHSA-2023:7382

Comment 25 errata-xmlrpc 2023-11-21 11:42:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7398 https://access.redhat.com/errata/RHSA-2023:7398

Comment 26 errata-xmlrpc 2023-11-21 11:42:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7410 https://access.redhat.com/errata/RHSA-2023:7410

Comment 27 errata-xmlrpc 2023-11-21 12:24:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:7411 https://access.redhat.com/errata/RHSA-2023:7411

Comment 28 errata-xmlrpc 2023-11-21 14:43:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2023:7417 https://access.redhat.com/errata/RHSA-2023:7417

Comment 29 errata-xmlrpc 2023-11-21 15:08:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:7424 https://access.redhat.com/errata/RHSA-2023:7424

Comment 30 errata-xmlrpc 2023-11-21 15:26:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:7431 https://access.redhat.com/errata/RHSA-2023:7431

Comment 31 errata-xmlrpc 2023-11-21 15:26:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:7419 https://access.redhat.com/errata/RHSA-2023:7419

Comment 32 errata-xmlrpc 2023-11-21 15:31:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:7434 https://access.redhat.com/errata/RHSA-2023:7434

Comment 33 errata-xmlrpc 2023-11-21 15:37:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:7423 https://access.redhat.com/errata/RHSA-2023:7423

Comment 35 errata-xmlrpc 2024-01-16 15:53:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:0262 https://access.redhat.com/errata/RHSA-2024:0262

Comment 36 errata-xmlrpc 2024-04-16 00:20:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2024:1831 https://access.redhat.com/errata/RHSA-2024:1831