CVE-2024-0193 Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: Use After Free
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_e4s:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::nfv
cpe:/a:redhat:rhel_e4s:9.0::realtime
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/o:redhat:rhel_eus:9.2::baseos
cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::realtime
cpe:/a:redhat:rhel_eus:9.2::nfv
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: RHOL-5.8-RHEL-9
cpes: cpe:/a:redhat:logging:5.8::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-02T18:05:13.332Z