CVE-2023-6622: Kernel: null pointer dereference vulnerability in nft_dynset_init()

Published Dec 8, 2023
·
Updated

A null pointer dereference vulnerability was found in nftdynsetinit() in net/netfilter/nftdynset.c in nftables in the Linux kernel. This issue may allow a local attacker with CAPNETADMIN user privilege to trigger a denial of service.

Other sources

In nftdynsetinit(), dynsetexpr->ops is checked against set->exprs[i]->ops at (0) and set->exprs[i] may be NULL here. if set->numexprs == 1, which means set->exprs[1] is NULL, and i == 1, the check at (1) will be passed and set->exprs[1] will be accessed, causing a kernel crash.

Refer: https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72bea

Red Hat

Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the nftdynsetinit() function in net/netfilter/nftdynset.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

IBM

Affected Software

15 affected componentsFixes available
Linux Linux kernel<=6.6
Linux Linux kernel=6.7-rc1
Linux Linux kernel=6.7-rc2
Linux Linux kernel=6.7-rc3
Linux Linux kernel=6.7-rc4
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
IBM Security Verify Governance<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Software Stack<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Virtual Appliance<=ISVG 10.0.2
IBM Security Verify Governance Identity Manager Container<=ISVG 10.0.2
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.27-1
Fedoraproject Fedora=38
Fedoraproject Fedora=39
Linux Linux kernel>=5.11<=6.6

Remediation

Mitigation

If not needed, disable the ability for unprivileged users to create namespaces. To do this temporarily, do: sudo sysctl -w kernel.unprivileged_userns_clone=0 To disable across reboots, do: echo kernel.unprivileged_userns_clone=0 | \ sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Event History

Dec 8, 2023
Data Sourced
via Red Hat·11:56 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·05:33 PM
Data Sourced
via MITRE·05:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 2, 2024
Data Sourced
via Launchpad·11:37 PM
Description
Apr 27, 2025
Data Sourced
via Ubuntu·12:39 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2023-6622?

CVE-2023-6622 is a null pointer dereference vulnerability in nft_dynset_init() in nf_tables in the Linux kernel.

2

How severe is CVE-2023-6622?

CVE-2023-6622 has a severity rating of medium, with a CVSS score of 5.5.

3

How does CVE-2023-6622 impact the system?

CVE-2023-6622 can allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.

4

What is the fix for CVE-2023-6622?

To fix CVE-2023-6622, apply the patch provided by the Linux kernel developers.

5

Where can I find more information about CVE-2023-6622?

You can find more information about CVE-2023-6622 at the following references: [Red Hat Security Advisory](https://access.redhat.com/security/cve/CVE-2023-6622), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2253632), [Linux Kernel Commit](https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72bea).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203