CVE-2023-4208
Assigner: Google
Published: 2023-09-06T13:53:23.843Z
State: PUBLISHED
title: Use-after-free in Linux kernel's net/sched: cls_u32 component
datePublic: 2023-08-01T03:10:36+00:00
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
impacts: capecId: CAPEC-233
descriptions: value: CAPEC-233 Privilege Escalation
affected: vendor: Linux
product: Kernel
packageName: kernel
repo: https://git.kernel.org
versions: status: affected
version: 3.18
lessThan: 6.5
versionType: custom
defaultStatus: unaffected
descriptions: value: A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.


metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
credits: value: valis
user: 00000000-0000-4000-9000-000000000000
type: finder
value: Muhammad Alifa Ramdhan of STAR Labs
user: 00000000-0000-4000-9000-000000000000
type: finder
source: discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev