7.8

CVE-2024-0193

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.2_aarch64
Redhat ≫ Enterprise Linux For Arm64 Version9.2 HwPlatformaarch64
Redhat ≫ Enterprise Linux For Arm64 Els Version9.2 HwPlatformaarch64
Redhat ≫ Codeready Linux Builder For Arm64 Version9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Els Version9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Els Version9.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.0_aarch64
Linux ≫ Linux Kernel Version >= 5.10.198 < 5.10.206
Linux ≫ Linux Kernel Version >= 5.15.118 < 5.15.146
Linux ≫ Linux Kernel Version >= 6.1.35 < 6.1.71
Linux ≫ Linux Kernel Version >= 6.3.9 < 6.6.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.339
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
secalert@redhat.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://bugzilla.redhat.com/show_bug.cgi?id=2255653
Patch
Third Party Advisory
Issue Tracking