CVE-2023-3390: Fixes in Linux Kernel
A flaw in the Linux Kernel found in the Netfilter nftables (net/netfilter/nftablesapi.c). It can lead to use after free vulnerability in nftables when handling sets that are both named and anonymous in batch requests. Nftables allows creating a named set that can be also marked as anonymous by setting the NFTSETANONYMOUS flag. When a rule referencing this malformed set is destroyed, the set gets destroyed as well, as the set is marked anonymous. It is possible to get nftables to destroy the rule, by mangling certain bytes within the rule's bytecode. As this is a named set, the set can be referenced in a different rule at which point it triggers a use after free. The caveat is that all of this needs to be performed in a batch transaction. This is because the reference of any set created in a batch transaction remains in the transactions list even after the set is destroyed.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97
Other sources
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nftablesapi.c.
Mishandled error handling with NFTMSGNEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.
We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97
— MITRE
Use-after-free in Linux kernel's netfilter subsystem
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.88-1Fixed in 7.0.7-1 - Upgrade
Upgrade
linux/kernel (net/netfilter/nf_tables_api.c)to a version that resolves this vulnerability.Patch commit 1240eb93f0616b21c675416516ff3d74798fdc97 - Configuration
Disable unprivileged user namespaces to mitigate the use-after-free/privilege escalation in nftables: set kernel.unprivileged_userns_clone=0 (temporary: sysctl -w kernel.unprivileged_userns_clone=0; persistent: write /etc/sysctl.d/99-disable-unpriv-userns.conf with kernel.unprivileged_userns_clone=0).
Linux kernel nf_tables / user namespaces kernel.unprivileged_userns_clone = 0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-4369
- CVE-2023-20593
- CVE-2023-4211
- CVE-2023-4128
- CVE-2023-4147
- CVE-2023-32804
- CVE-2022-40982
- CVE-2023-2312
- CVE-2023-4349
- CVE-2023-4350
- CVE-2023-4351
- CVE-2023-4352
- CVE-2023-4353
- CVE-2023-4354
- CVE-2023-4355
- CVE-2023-4356
- CVE-2023-4357
- CVE-2023-4358
- CVE-2023-4359
- CVE-2023-4360
- CVE-2023-4361
- CVE-2023-4362
- CVE-2023-4363
- CVE-2023-4364
- CVE-2023-4365
- CVE-2023-4366
- CVE-2023-4367
- CVE-2023-4368
- CVE-2023-21264
- CVE-2020-29374
Frequently Asked Questions
What is the severity of CVE-2023-3390?
CVE-2023-3390 has a medium severity rating, indicating a significant impact on affected systems.
How do I fix CVE-2023-3390?
To fix CVE-2023-3390, update your Linux Kernel to the latest versions specified in your distribution's release notes.
Which systems are affected by CVE-2023-3390?
CVE-2023-3390 affects various versions of the Linux Kernel, specifically those ranging from 3.16 to 6.4.
What type of vulnerability is CVE-2023-3390?
CVE-2023-3390 is a use-after-free vulnerability specifically occurring in the Netfilter nf_tables implementation.
Can CVE-2023-3390 lead to remote code execution?
Yes, CVE-2023-3390 could potentially allow an attacker to execute arbitrary code on affected systems.