Published: 05/07/2023 Updated: 11/01/2024

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

This vulnerability allows local malicious users to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of nft chains. The issue results from incorrect pointer scaling, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
debian debian linux 11.0
fedoraproject fedora 37
fedoraproject fedora 38
netapp h300s -
netapp h500s -
netapp h700s -
netapp h410s -
netapp h410c -

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2023-2156 It was discovered that a flaw in the handling of the RPL protocol may allow an unauthenticated remote attacker to cause a denial of service if RPL is enabled (not by default in ...

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (CVE-2023-31 ...

Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...

Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Securit ...

概要 Important: OpenShift Container Platform 41317 bug fix and security update タイプ/重大度 Security Advisory: Important トピック Red Hat OpenShift Container Platform release 41317 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Ha ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Securit ...

Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 76 Advanced Update SupportRed Hat Product Security has rated ...

Synopsis Important: Logging Subsystem 577 - Red Hat OpenShift security update Type/Severity Security Advisory: Important Topic Logging Subsystem 577 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed sev ...

Synopsis Important: Logging Subsystem 5612 - Red Hat OpenShift security update Type/Severity Security Advisory: Important Topic Logging Subsystem 5612 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed s ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product S ...

概述 Important: kpatch-patch security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析识别并修复受此公告影响的系统。查看受影响的系统标题 An update for kpatch-patch is now available for Red Hat Enterprise Linux 84 Update Services for SAP SolutionsRed Hat Product Securi ...

Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...

Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Securit ...

Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 77 Advanced Update SupportRed Hat Product Security has rated ...

概要 Important: kernel-rt security and bug fix update タイプ/重大度 Security Advisory: Important Red Hat Insights パッチ分析このアドバイザリーの影響を受けるシステムを特定し、修正します。影響を受けるシステムの表示トピック An update for kernel-rt is now available for Red ...

DescriptionThe MITRE CVE dictionary describes this issue as: Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace ...

Critical Infrastructure Sectors: Critical Manufacturing

nftables oob read/write exploit (CVE-2023-35001)

nftables oob read/write exploit (CVE-2023-35001) Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop The exploit supports the kernel version available at the beginning of the event (5190-35) Requirements C compiler Go compiler Usage # Build $ make # Run $ /exploit This produces a lpezip file which can be unpacked on the targ

Pwn2Own Vancouver 2023 Ubuntu LPE exploit

CWE-787 https://lore.kernel.org/netfilter-devel/20230705121515.747251-1-cascardo@canonical.com/T/https://www.openwall.com/lists/oss-security/2023/07/05/3 http://www.openwall.com/lists/oss-security/2023/07/05/3 https://www.debian.org/security/2023/dsa-5453 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPHI46ROSSLVAV4R5LJWJYU747JGOS6D/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E/http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html https://security.netapp.com/advisory/ntap-20230824-0007/http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5453 https://github.com/syedhafiz1234/nftables-oob-read-write-exploit-CVE-2023-35001-https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11 https://www.zerodayinitiative.com/advisories/ZDI-23-900/

Get Started

CVE-2023-35001

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect