CVE-2023-32233

Published: 8 May 2023

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

From the Ubuntu Security Team

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

requires CAP_NET_ADMIN, however this can be done within a new
user namespace and network namespace - so can be mitigated by disabling
unprivileged user namespaces.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32233
• https://www.openwall.com/lists/oss-security/2023/05/08/4
• https://www.openwall.com/lists/oss-security/2023/05/15/5
• https://ubuntu.com/security/notices/USN-6122-1
• https://ubuntu.com/security/notices/USN-6123-1
• https://ubuntu.com/security/notices/USN-6124-1
• https://ubuntu.com/security/notices/USN-6127-1
• https://ubuntu.com/security/notices/USN-6130-1
• https://ubuntu.com/security/notices/USN-6131-1
• https://ubuntu.com/security/notices/USN-6132-1
• https://ubuntu.com/security/notices/USN-6135-1
• NVD
• Launchpad
• Debian