7.8
CVSSv3

CVE-2023-4623

Published: 06/09/2023 Updated: 11/01/2024
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 0

Vulnerability Summary

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

debian debian linux 10.0

Vendor Advisories

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Securit ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Securit ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Securit ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Securit ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 84 Update Services for SAP SolutionsRed Hat Produ ...
概述 Important: kpatch-patch security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for kpatch-patch is now available for Red Hat Enterprise Linux 92 Extended Update SupportRed Hat Product Security has rat ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Securit ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...
Synopsis Important: OpenShift Container Platform 41247 security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41247 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container P ...
A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service (CVE-2023-3772) A use-after-free vulnerability in the Linux ke ...
DescriptionThe MITRE CVE dictionary describes this issue as: A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation If a class with a link-sharing curve (ie with the HFSC_FSC flag set) has a parent without a link-sharing curve, then in ...
A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service (CVE-2023-3772) The upstream commit describes this issue as fo ...
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation If a class with a link-sharing curve (ie with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_r ...
The upstream commit describes this issue as follows: The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow As a result, it leads to slab out-of-bound access (CVE-2023-42753) A use-after-free vulnerability in the Linux kernel's ...
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter This causes a problem when updating a filter bound to a class, as tcf_unbind_filt ...
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances We recommend upgrading past commi ...
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter This causes a problem when updating a filter bound to a class, as tcf_unbind_filt ...
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation If a class with a link-sharing curve (ie with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_r ...
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter This causes a problem when updating a filter bound to a class, as tcf_unbi ...
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation If a class with a link-sharing curve (ie with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_r ...
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter This causes a problem when updating a filter bound to a class, as tcf_unbind_filt ...
A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service (CVE-2023-3772) A use-after-free vulnerability in the Linux ke ...