CVE-2023-4208

A use-after-free vulnerability in the Linux kernel’s net/sched: cls_u32
component can be exploited to achieve local privilege escalation. When
u32_change() is called on an existing filter, the whole tcf_result struct
is always copied into the new instance of the filter. This causes a problem
when updating a filter bound to a class, as tcf_unbind_filter() is always
called on the old instance in the success path, decreasing filter_cnt of
the still referenced class and allowing it to be deleted, leading to a
use-after-free. We recommend upgrading past commit
3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=2237757&gt;
• <https://bugzilla.suse.com/show_bug.cgi?id=1215114&gt;

Notes