CVE-2023-4207

A use-after-free vulnerability in the Linux kernel’s net/sched: cls_fw
component can be exploited to achieve local privilege escalation. When
fw_change() is called on an existing filter, the whole tcf_result struct is
always copied into the new instance of the filter. This causes a problem
when updating a filter bound to a class, as tcf_unbind_filter() is always
called on the old instance in the success path, decreasing filter_cnt of
the still referenced class and allowing it to be deleted, leading to a
use-after-free. We recommend upgrading past commit
76e42ae831991c828cffa8c37736ebfb831ad5ec.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=2237757&gt;
• <https://bugzilla.suse.com/show_bug.cgi?id=1215113&gt;

Notes