In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360690f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3106f3f00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3841231c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341731500> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360690080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3606924c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368e88f40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e28bc0> | Operating System |
| redhat | enterprise_linux | 7.0 | <built-in method update of dict object at 0x7fd289fb9940> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd360693ac0> | Operating System |
| redhat | enterprise_linux | 9.0 | <built-in method update of dict object at 0x7fd3606918c0> | Operating System |
| netapp | hci_baseboard_management_controller | h300s | <built-in method update of dict object at 0x7fd38465bb80> | Application |
| netapp | hci_baseboard_management_controller | h410c | <built-in method update of dict object at 0x7fd360693b40> | Application |
| netapp | hci_baseboard_management_controller | h410s | <built-in method update of dict object at 0x7fd384122f00> | Application |
| netapp | hci_baseboard_management_controller | h500s | <built-in method update of dict object at 0x7fd360692e00> | Application |
| netapp | hci_baseboard_management_controller | h700s | <built-in method update of dict object at 0x7fd360691ac0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:* |