CVE-2023-6111

Published: 14 November 2023

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630.

From the Ubuntu Security Team

Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle an expired catchall element in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Google kCTF submission
for 5.15 kernels, there was never a release with the commit
that introduces the issue. in version 5.15.0-94.104 for the
generic kernel, and for the kernels that derivate from that
version, both the break and the fix commit were added, but
still, there is no vulnerable version released. hence,
Ubuntu 5.15 kernels are not-affected.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93995bf4af2c5a99e2a87f0cd5ce547d31eb7630
• https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231106113447.14290-1-pablo@netfilter.org/
• https://ubuntu.com/security/notices/USN-6576-1
• https://www.cve.org/CVERecord?id=CVE-2023-6111
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2250105
• https://bugzilla.suse.com/show_bug.cgi?id=1217164