CVE-2023-3609: Use-after-free in Linux kernel's net/sched: cls_u32 component
A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev() fails, u32setparms() will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bc
Other sources
A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation.
If tcfchangeindev() fails, u32setparms() will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in the net/sched: clsu32 component. By sending a specially crafted request using the reference counter, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.4 - Upgrade
Upgrade
Linux Kernel net/sched: cls_u32to a version that resolves this vulnerability.Patch 04c55383fa5689357bcdd2c8036725a55ed632bc - Configuration
Disable unprivileged user namespaces (to reduce exposure of the local authenticated attacker path): run `sudo sysctl -w kernel.unprivileged_userns_clone=0` and persist across reboots by creating `/etc/sysctl.d/99-disable-unpriv-userns.conf` with `kernel.unprivileged_userns_clone=0`.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3609?
CVE-2023-3609 is classified as a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2023-3609?
To address CVE-2023-3609, upgrade the Linux kernel to version 6.4 or apply the recommended patches.
Which Linux versions are affected by CVE-2023-3609?
CVE-2023-3609 affects Linux kernel versions from 4.14 up to but not including 6.4.
What components are impacted by CVE-2023-3609?
CVE-2023-3609 affects the cls_u32 component of the Linux kernel's networking subsystem.
Is CVE-2023-3609 exploitable remotely?
CVE-2023-3609 is not known to be exploitable remotely, as it requires local access to achieve privilege escalation.