Bug 2218605 - kernel: use-after-free vulnerability under netfilter because of incorrect error path handling with NFT_MSG_NEWRULE
Summary: kernel: use-after-free vulnerability under netfilter because of incorrect err...
Keywords:
Status: CLOSED DUPLICATE of bug 2213260
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2213271 2214035 2214963 2214964 2218636 2218637 2219131 2219132 2219133
Blocks: 2218602
TreeView+ depends on / blocked
 
Reported: 2023-06-29 15:34 UTC by Patrick Del Bello
Modified: 2023-12-07 15:52 UTC (History)
45 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-07-06 09:08:16 UTC
Embargoed:

Attachments (Terms of Use)

Description Patrick Del Bello 2023-06-29 15:34:36 UTC 
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.

Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause an out-of-bounds read issue.

We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.

References:
https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97
Comment 4 Alex 2023-07-02 11:36:54 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2219131]
Comment 6 Justin M. Forbes 2023-07-03 18:02:13 UTC 
This was fixed for Fedora with the 6.3.9 stable kernel updates.
Comment 7 Phil Sutter 2023-07-05 13:15:29 UTC 
I think we can treat this as duplicate of CVE-2023-3117, the suggested fix is the same.
Comment 8 Alex 2023-07-06 09:08:16 UTC 
Thank you. Closing this one as duplicate of the flaw 2213260,
so the CVE-2023-3390 is duplicate of the CVE-2023-3117 (and keeping original CVE-2023-3117 only).

*** This bug has been marked as a duplicate of bug 2213260 ***
Note You need to log in before you can comment on or make changes to this bug.