CVE-2023-4128

Published: 10 August 2023

A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue.

From the Ubuntu Security Team

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.

the fix commits can be found split in CVE-2023-4206,
CVE-2023-4207 and CVE-2023-4208. these 3 are likely to be marked as
duplicated.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4128
• https://git.kernel.org/linus/3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 (6.5-rc5)
• https://git.kernel.org/linus/76e42ae831991c828cffa8c37736ebfb831ad5ec (6.5-rc5)
• https://git.kernel.org/linus/b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 (6.5-rc5)
• https://lore.kernel.org/netdev/193d6cdf-d6c9-f9be-c36a-b2a7551d5fb6@mojatatu.com/
• https://access.redhat.com/security/cve/CVE-2023-4128
• https://ubuntu.com/security/notices/USN-6343-1
• https://ubuntu.com/security/notices/USN-6383-1
• https://ubuntu.com/security/notices/USN-6385-1
• https://ubuntu.com/security/notices/USN-6386-1
• https://ubuntu.com/security/notices/USN-6387-1
• https://ubuntu.com/security/notices/USN-6388-1
• https://ubuntu.com/security/notices/USN-6396-1
• https://ubuntu.com/security/notices/USN-6387-2
• https://ubuntu.com/security/notices/USN-6386-2
• https://ubuntu.com/security/notices/USN-6386-3
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2225511
• https://bugzilla.suse.com/show_bug.cgi?id=1214149