CVE-2023-35001

Published: 5 July 2023

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

From the Ubuntu Security Team

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

reporter at Pwn2Own 2023 as ZDI-CAN-20721
CWE-787

requires CAP_NET_ADMIN in any network namespace

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
    sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
    echo kernel.unprivileged_userns_clone=0 | \
    sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://lore.kernel.org/netfilter-devel/20230705121515.747251-1-cascardo@canonical.com/T/
• https://www.openwall.com/lists/oss-security/2023/07/05/3
• https://www.zerodayinitiative.com/advisories/ZDI-23-900/
• https://ubuntu.com/security/notices/USN-6246-1
• https://ubuntu.com/security/notices/USN-6247-1
• https://ubuntu.com/security/notices/USN-6248-1
• https://ubuntu.com/security/notices/USN-6250-1
• https://ubuntu.com/security/notices/USN-6251-1
• https://ubuntu.com/security/notices/USN-6252-1
• https://ubuntu.com/security/notices/USN-6254-1
• https://ubuntu.com/security/notices/USN-6255-1
• https://ubuntu.com/security/notices/USN-6260-1
• https://ubuntu.com/security/notices/USN-6261-1
• https://ubuntu.com/security/notices/USN-6285-1
• https://ubuntu.com/security/notices/USN-6460-1
• https://www.cve.org/CVERecord?id=CVE-2023-35001
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2220892