CVE-2023-5197

2023-09-2715:19:43

CWE-416

[email protected]

web.nvd.nist.gov

linux

kernel

netfilter

nf_tables

vulnerability

use-after-free

local privilege escalation

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A use-after-free vulnerability in the Linux kernel’s netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

Affected configurations

Vulners

NVD

Node

linuxlinux_kernelRange5.9–6.6

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::

CNA Affected

[
  {
    "vendor": "Linux",
    "product": "Kernel",
    "packageName": "kernel",
    "repo": "https://git.kernel.org",
    "versions": [
      {
        "status": "affected",
        "version": "5.9",
        "lessThan": "6.6",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]