Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ZKWjtBNBcNYlmDu7@quatroqueijos.cascardo.eti.br>
Date: Wed, 5 Jul 2023 14:09:08 -0300
From: Thadeu Lima de Souza Cascardo <cascardo@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-35001 - Linux kernel nf_tables nft_byteorder_eval OOB
 read/write

It was discovered that it was possible to cause an out-of-bounds read or
write when processing an nft_byteorder expression.

Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with Trend Micro's Zero
Day Initiative discovered that this vulnerability could be exploited for
Local Privilege Escalation. This has been reported as ZDI-CAN-20721, and
assigned CVE-2023-35001.

Exploiting it requires CAP_NET_ADMIN in any user or network namespace.

This bug was introduced by commit 96518518cc41 ("netfilter: add nftables"),
which is present since v3.13-rc1.

A fix has been sent to netfilter-devel@...r.kernel.org and is at
https://lore.kernel.org/netfilter-devel/20230705121515.747251-1-cascardo@canonical.com/T/.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.