CVE-2023-5197
Description
A use-after-free vulnerability was found in net/netfilter/nf_tables_api.c in the netfilter component in the Linux Kernel. This flaw can be exploited to achieve local privilege escalation. Adding and removing rules from chain bindings within the same transaction leads to a use-after-free issue.
Statement
Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.
Also, on non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting the user.max_user_namespaces to 0:
echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
sysctl -p /etc/sysctl.d/userns.conf
On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality needs to be enabled.
Mitigation
Mitigation for this issue is to skip loading the affected module "netfilter" onto the system until we have a fix available. This can be done by a blacklist mechanism and will ensure the driver is not loaded at the boot time.
How do I blacklist a kernel module to prevent it from loading automatically?
https://access.redhat.com/solutions/41278
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | 6.6 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | Low | High |
| Integrity Impact | Low | Low | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Data Integrity and confidentially breach in this should be limited to TCP protocol and not to whole kernel, thus C:L and I:L. Also exploitation of this issue will need CAP_NET_ADMIN access privilege.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
