kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation

A use-after-free vulnerability was found in the Netfilter subsystem of the Linux kernel when processing batch requests to update nftables configuration. This vulnerability can be abused to perform arbitrary reads and writes in kernel memory. A local user with CAPNETADMIN capability could use this...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

RSEC-2023-6 Denial of Service (DoS) vulnerability

The commonmark package, specifically in its dependency on GitHub Flavored Markdown before version 0.29.0.gfm.1, has a vulnerability related to time complexity. Parsing certain crafted markdown tables can take On n time, leading to potential Denial of Service attacks. This issue does not affect th...

kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation

A use-after-free vulnerability was found in the Netfilter subsystem of the Linux kernel when processing batch requests to update nftables configuration. This vulnerability can be abused to perform arbitrary reads and writes in kernel memory. A local user with CAPNETADMIN capability could use this...

Use-after-free in Linux kernel's netfilter: nf_tables component

...

Vulnerabilities of functions nftFlushTable(), nfTablesDelChain(), nfTablesNewRule(), nfTablesDelRule(), and __nftReleaseTable() in Linux kernel, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information, or enhance their privileges.

The vulnerabilities of the functions nftFlushTable, nfTablesDelChain, nfTablesNewRule, nfTablesDelRule, and nftReleaseTable in the Linux kernel are related to the reutilization of previously freed memory. Exploiting these vulnerabilities can allow an attacker to compromise the confidentiality,...

CVE-2023-33972

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

CVE-2023-33972 Privilege escalation from having CREATE access on a keyspace in Scylladb

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

UBUNTU-CVE-2023-5197

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a memory misreference vulnerability that originates from a confusion in the instructions responsible for freeing memory in the netfilter: nftables...

pimcore Security Vulnerabilities

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in pimcore dem...

CLSA-2023-1695716575 kernel: Fix of 25 CVEs

xen/xenbus: don't let xenbusgrantring remove grants in error case CVE-2022-23040 - xen/xenbus: Fix granting of vmalloc'd memory - xen/blkfront: don't use gnttabqueryforeignaccess for mapped status CVE-2022-23036 - xen/grant-table: add gnttabtryendforeignaccess CVE-2022-23036 - xen/blkfront: don't...

CLSA-2023-1695715460 kernel: Fix of 24 CVEs

xen/xenbus: don't let xenbusgrantring remove grants in error case CVE-2022-23040 - xen/xenbus: Fix granting of vmalloc'd memory - xen/blkfront: don't use gnttabqueryforeignaccess for mapped status CVE-2022-23036 - xen/grant-table: add gnttabtryendforeignaccess CVE-2022-23036 - xen/blkfront: don't...

DEBIAN-CVE-2023-40619

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the...

kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()

An out-of-bounds OOB memory access flaw was found in the Netfilter module in the Linux kernel's nftbyteordereval in net/netfilter/nftbyteorder.c. A bound check failure allows a local attacker with CAPNETADMIN access to cause a local privilege escalation issue due to incorrect data alignment...

[SECURITY] Fedora 39 Update: rubygem-activerecord-7.0.7.2-1.fc39

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties database tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

OESA-2023-1636 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2SESSIONSETUP commands. The issue results from the lack of control of resource consumption...

The vulnerability of the Item_field::used_tables/update_depend_map_for_order component of the MariaDB database management system, which allows a hacker to trigger a service failure.

The vulnerability of the Itemfield::usedtables/updatedependmapfororder component of the MariaDB database management system is related to the use of the assert function or similar operators. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE

A use-after-free vulnerability was found in the netfilter: nftables component in the Linux kernel due to a missing error handling in the abort path of NFTMSGNEWRULE. This flaw allows a local attacker with CAPNETADMIN access capability to cause a local privilege escalation problem...

kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE

A use-after-free vulnerability was found in the netfilter: nftables component in the Linux kernel due to a missing error handling in the abort path of NFTMSGNEWRULE. This flaw allows a local attacker with CAPNETADMIN access capability to cause a local privilege escalation problem...