CVE-2023-4004

Published: 31 July 2023

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

From the Ubuntu Security Team

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.

Notes

Priority reason:
nftables can be exploited by unprivileged users using user namespaces.

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4004
• https://git.kernel.org/linus/87b5a5c209405cb6b57424cdfa226a6dbd349232 (6.5-rc3)
• https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/
• https://ubuntu.com/security/notices/USN-6315-1
• https://ubuntu.com/security/notices/USN-6316-1
• https://ubuntu.com/security/notices/USN-6318-1
• https://ubuntu.com/security/notices/USN-6321-1
• https://ubuntu.com/security/notices/USN-6325-1
• https://ubuntu.com/security/notices/USN-6328-1
• https://ubuntu.com/security/notices/USN-6330-1
• https://ubuntu.com/security/notices/USN-6332-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2225275
• https://bugzilla.suse.com/show_bug.cgi?id=1213812