CVE-2023-3776

Published: 21 July 2023

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

From the Ubuntu Security Team

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3776
• https://git.kernel.org/linus/0323bce598eea038714f941ce2b22541c46d488f (6.5-rc2)
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=0323bce598eea038714f941ce2b22541c46d488f
• https://kernel.dance/0323bce598eea038714f941ce2b22541c46d488f
• https://ubuntu.com/security/notices/USN-6285-1
• https://ubuntu.com/security/notices/USN-6309-1
• https://ubuntu.com/security/notices/USN-6315-1
• https://ubuntu.com/security/notices/USN-6317-1
• https://ubuntu.com/security/notices/USN-6318-1
• https://ubuntu.com/security/notices/USN-6321-1
• https://ubuntu.com/security/notices/USN-6324-1
• https://ubuntu.com/security/notices/USN-6325-1
• https://ubuntu.com/security/notices/USN-6327-1
• https://ubuntu.com/security/notices/USN-6328-1
• https://ubuntu.com/security/notices/USN-6329-1
• https://ubuntu.com/security/notices/USN-6330-1
• https://ubuntu.com/security/notices/USN-6331-1
• https://ubuntu.com/security/notices/USN-6332-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2225097
• https://bugzilla.suse.com/show_bug.cgi?id=1213588