CVE-2023-31248

Published: 5 July 2023

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace

From the Ubuntu Security Team

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

reporter at Pwn2Own 2023 as ZDI-CAN-20717
CWE-416

requires CAP_NET_ADMIN in any namespace, not just the init
namespace.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
    sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
    echo kernel.unprivileged_userns_clone=0 | \
    sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31248
• https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/
• https://www.openwall.com/lists/oss-security/2023/07/05/2
• https://www.zerodayinitiative.com/advisories/ZDI-23-899/
• https://ubuntu.com/security/notices/USN-6246-1
• https://ubuntu.com/security/notices/USN-6247-1
• https://ubuntu.com/security/notices/USN-6248-1
• https://ubuntu.com/security/notices/USN-6250-1
• https://ubuntu.com/security/notices/USN-6255-1
• https://ubuntu.com/security/notices/USN-6260-1
• https://ubuntu.com/security/notices/USN-6285-1
• NVD
• Launchpad
• Debian