CVE-2023-32233: [CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in Netfilter nftables when processing batch requests. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges as root.
— IBM
Use-After-Free in Netfilter nftables (net/netfilter/nftablesapi.c) can be abused by unprivileged local users to execute arbitrary Kernel code.
The issue has been reproduced on: the current kernel build 5.19.0-41-generic (x8664) on Ubuntu 22.10, and the current mainline v6.3 (commit 457391b0380335d5e9a5babdec90ac53928b23b4).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.96-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.3.1Patch CVE-2023-32233 - Configuration
Disable unprivileged user namespace creation to mitigate the local privilege escalation risk: run `sudo sysctl -w kernel.unprivileged_userns_clone=0` and persist across reboots by writing `kernel.unprivileged_userns_clone=0` to `/etc/sysctl.d/99-disable-unpriv-userns.conf`.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32233?
CVE-2023-32233 has been classified as a critical vulnerability due to the potential for unprivileged local users to obtain root privileges.
How do I fix CVE-2023-32233?
To fix CVE-2023-32233, update the Linux kernel to version 6.3.2 or later, or apply specific patches provided by your Linux distribution.
Which systems are affected by CVE-2023-32233?
CVE-2023-32233 impacts various versions of the Linux kernel, specifically versions prior to 6.3.2, including several distributions like Red Hat and Debian.
What type of vulnerability is CVE-2023-32233?
CVE-2023-32233 is a use-after-free vulnerability in the Netfilter nf_tables subsystem of the Linux kernel.
Can CVE-2023-32233 be exploited remotely?
CVE-2023-32233 cannot be exploited remotely as it requires unprivileged local users to access the vulnerable system.