CVE-2023-3609

2023-07-2100:00:00

ubuntu.com

linux kernel

use-after-free

vulnerability

local privilege escalation

net/sched: cls_u32

tcf_change_indev()

u32_set_parms()

tcf_bind_filter()

bugzilla

user namespaces

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A use-after-free vulnerability in the Linux kernel’s net/sched: cls_u32
component can be exploited to achieve local privilege escalation. If
tcf_change_indev() fails, u32_set_parms() will immediately return an error
after incrementing or decrementing the reference counter in
tcf_bind_filter(). If an attacker can control the reference counter and set
it to zero, they can cause the reference to be freed, leading to a
use-after-free vulnerability. We recommend upgrading past commit
04c55383fa5689357bcdd2c8036725a55ed632bc.

Bugs

Notes

Author	Note
	Priority reason: By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-159.176UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-82.91UNKNOWN
ubuntu23.04noarchlinux< 6.2.0-31.31UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1108.116UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1043.48UNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1010.10UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1043.48~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1108.116~18.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.2< 6.2.0-1010.10~22.04.1UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1114.120UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-159.176	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-82.91	UNKNOWN
ubuntu	23.04	noarch	linux	< 6.2.0-31.31	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1108.116	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1043.48	UNKNOWN
ubuntu	23.04	noarch	linux-aws	< 6.2.0-1010.10	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1043.48~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1108.116~18.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.2	< 6.2.0-1010.10~22.04.1	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1114.120	UNKNOWN