CVE-2023-4015

Published: 3 August 2023

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

From the Ubuntu Security Team

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.

Notes

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.

Google kCTF submission

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a771f7b266b02d262900c75f1e175c7fe76fec2
• https://google.github.io/security-research/kernelctf/rules
• https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230723142446.13809-1-pablo@netfilter.org/
• https://ubuntu.com/security/notices/USN-6315-1
• https://ubuntu.com/security/notices/USN-6316-1
• https://ubuntu.com/security/notices/USN-6318-1
• https://ubuntu.com/security/notices/USN-6321-1
• https://ubuntu.com/security/notices/USN-6325-1
• https://ubuntu.com/security/notices/USN-6328-1
• https://ubuntu.com/security/notices/USN-6330-1
• https://ubuntu.com/security/notices/USN-6332-1
• https://ubuntu.com/security/notices/USN-6348-1
• https://ubuntu.com/security/notices/USN-6385-1
• https://www.cve.org/CVERecord?id=CVE-2023-4015
• NVD
• Launchpad
• Debian