[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ZKWjO36sTTiRedC3@quatroqueijos.cascardo.eti.br>
Date: Wed, 5 Jul 2023 14:07:07 -0300
From: Thadeu Lima de Souza Cascardo <cascardo@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-31248 - Linux kernel nf_tables UAF when using
nft_chain_lookup_byid
It was discovered that it was possible to refer to a deleted nf_tables
chain when using nft_chain_lookup_byid, leading to a potential
use-after-free.
Mingi Cho of Theori working with Trend Micro's Zero Day Initiative
discovered that this vulnerability could be exploited for Local Privilege
Escalation. This has been reported as ZDI-CAN-20717, and assigned
CVE-2023-31248.
Exploiting it requires CAP_NET_ADMIN in any user or network namespace.
This bug was introduced by commit 837830a4b439 ("netfilter: nf_tables: add
NFTA_RULE_CHAIN_ID attribute"), which is present since v5.9-rc1. It was not
backported to any upstream LTS kernel.
A fix have been sent to netfilter-devel@...r.kernel.org and is at
https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
