A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Kernel | unaffected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | |||
| kernel-rt-0:3.10.0-1160.105.1.rt56.1256.el7 | cpe:/a:redhat:rhel_extras_rt:7 | RHSA-2023:7424 | 2023-11-21T00:00:00Z |
| kpatch-patch | cpe:/o:redhat:enterprise_linux:7 | RHSA-2023:7419 | 2023-11-21T00:00:00Z |
| kernel-0:3.10.0-1160.105.1.el7 | cpe:/o:redhat:enterprise_linux:7 | RHSA-2023:7423 | 2023-11-21T00:00:00Z |
| Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118) | |||
| kernel-0:3.10.0-957.109.1.el7 | cpe:/o:redhat:rhel_aus:7.6 | RHSA-2024:0261 | 2024-01-16T00:00:00Z |
| Red Hat Enterprise Linux 7.7 Advanced Update Support | |||
| kernel-0:3.10.0-1062.82.1.el7 | cpe:/o:redhat:rhel_aus:7.7 | RHSA-2024:0262 | 2024-01-16T00:00:00Z |
| Red Hat Enterprise Linux 8 | |||
| kernel-rt-0:4.18.0-513.5.1.rt7.307.el8_9 | cpe:/a:redhat:enterprise_linux:8::nfv | RHSA-2023:6901 | 2023-11-14T00:00:00Z |
| kernel-0:4.18.0-513.5.1.el8_9 | cpe:/o:redhat:enterprise_linux:8 | RHSA-2023:7077 | 2023-11-14T00:00:00Z |
| Red Hat Enterprise Linux 8.8 Extended Update Support | |||
| kernel-0:4.18.0-477.36.1.el8_8 | cpe:/o:redhat:rhel_eus:8.8 | RHSA-2023:7539 | 2023-11-28T00:00:00Z |
| kpatch-patch | cpe:/o:redhat:rhel_eus:8.8 | RHSA-2023:7558 | 2023-11-28T00:00:00Z |
| Red Hat Enterprise Linux 9 | |||
| kernel-0:5.14.0-362.8.1.el9_3 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2023:6583 | 2023-11-07T00:00:00Z |
| kernel-0:5.14.0-362.8.1.el9_3 | cpe:/o:redhat:enterprise_linux:9 | RHSA-2023:6583 | 2023-11-07T00:00:00Z |
| Red Hat Enterprise Linux 9.2 Extended Update Support | |||
| kernel-0:5.14.0-284.40.1.el9_2 | cpe:/a:redhat:rhel_eus:9.2 | RHSA-2023:7370 | 2023-11-21T00:00:00Z |
| kernel-rt-0:5.14.0-284.40.1.rt14.325.el9_2 | cpe:/a:redhat:rhel_eus:9.2::nfv | RHSA-2023:7379 | 2023-11-21T00:00:00Z |
| kpatch-patch | cpe:/o:redhat:rhel_eus:9.2 | RHSA-2023:7418 | 2023-11-21T00:00:00Z |
No data.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3710-1 | linux security update |
 Debian DSA |
DSA-5492-1 | linux security update |
 EUVD |
EUVD-2023-54080 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 13 Feb 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. | A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Google
Published:
Updated: 2025-02-13T17:09:16.643Z
Reserved: 2023-08-07T13:02:24.450Z
Link: CVE-2023-4206
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-09-06T14:15:11.280
Modified: 2025-02-13T17:17:16.240
Link: CVE-2023-4206
Redhat
OpenCVE Enrichment
No data.
Weaknesses