Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ZKWjO36sTTiRedC3@quatroqueijos.cascardo.eti.br>
Date: Wed, 5 Jul 2023 14:07:07 -0300
From: Thadeu Lima de Souza Cascardo <cascardo@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-31248 - Linux kernel nf_tables UAF when using
 nft_chain_lookup_byid

It was discovered that it was possible to refer to a deleted nf_tables
chain when using nft_chain_lookup_byid, leading to a potential
use-after-free.

Mingi Cho of Theori working with Trend Micro's Zero Day Initiative
discovered that this vulnerability could be exploited for Local Privilege
Escalation. This has been reported as ZDI-CAN-20717, and assigned
CVE-2023-31248.

Exploiting it requires CAP_NET_ADMIN in any user or network namespace.

This bug was introduced by commit 837830a4b439 ("netfilter: nf_tables: add
NFTA_RULE_CHAIN_ID attribute"), which is present since v5.9-rc1. It was not
backported to any upstream LTS kernel.

A fix have been sent to netfilter-devel@...r.kernel.org and is at
https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.