Bug 2225275 (CVE-2023-4004)

Summary:	CVE-2023-4004 kernel: netfilter: nft_set_pipapo: improper element removal in function nft_pipapo_remove when insert an element without a NFT_SET_EXT_KEY_END that can lead to use-after-free
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rhandlin, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, swood, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.5-rc5	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2225276, 2225277, 2227505, 2227506, 2227507, 2227508, 2227509, 2227510, 2227512, 2227513, 2227514, 2227515, 2227516, 2227517, 2227518, 2227519, 2228795, 2228796, 2228797, 2228798, 2228799, 2228800, 2227503, 2227504, 2227511, 2228794
Bug Blocks:	2225252

Description Alex 2023-07-24 20:33:46 UTC

A flaw in the Linux Kernel found. Improper element removal in function nft_pipapo_remove when insert an element without a NFT_SET_EXT_KEY_END that can lead to use-after-free.

Reference:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/

Comment 6 Alex 2023-07-30 11:29:39 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2227503]

Comment 13 Justin M. Forbes 2023-08-07 21:39:24 UTC

This was fixed for Fedora with the 6.4.7 stable kernel updates.