CVE-2023-6817

Published: 18 December 2023

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

From the Ubuntu Security Team

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
    sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
    echo kernel.unprivileged_userns_clone=0 | \
    sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a
• https://kernel.dance/#317eb9685095678f2c9f5a8189de698c5354316a
• https://www.openwall.com/lists/oss-security/2023/12/22/6
• https://ubuntu.com/security/notices/USN-6606-1
• https://ubuntu.com/security/notices/USN-6607-1
• https://ubuntu.com/security/notices/USN-6608-1
• https://ubuntu.com/security/notices/USN-6609-1
• https://ubuntu.com/security/notices/USN-6609-2
• https://ubuntu.com/security/notices/USN-6609-3
• https://ubuntu.com/security/notices/USN-6628-1
• https://ubuntu.com/security/notices/USN-6608-2
• https://ubuntu.com/security/notices/USN-6635-1
• https://ubuntu.com/security/notices/USN-6628-2
• https://www.cve.org/CVERecord?id=CVE-2023-6817
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• https://bugzilla.suse.com/show_bug.cgi?id=1218195