CVE-2023-31248

CWE-416Use After Free17 documents8 sources
Severity
7.8HIGH
EPSS
0.2%
top 57.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 5
Latest updateSep 5

Description

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

NVDlinux/linux_kernel5.95.10.188+3
CVEListV5linux/linux_kernelv5.9-rc1
Debianlinux< 5.10.179-2+3

Also affects: Debian Linux 11.0, Ubuntu Linux 14.04, 16.04, 18.04, 20.04, 22.04, Fedora 37, 38

Patches

🔴Vulnerability Details

5
OSV
linux-intel-iotg-5.15 vulnerabilities2023-07-26
CVEList
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability2023-07-05
OSV
CVE-2023-31248: Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active an2023-07-05
GHSA
GHSA-vr3g-637q-4rh6: Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active an2023-07-05
VulnCheck
Linux Kernel Use After Free2023

📋Vendor Advisories

11
Ubuntu
Kernel Live Patch Security Notice2023-09-05
Ubuntu
Linux kernel (OEM) vulnerabilities2023-08-11
Ubuntu
Linux kernel vulnerabilities2023-07-27
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities2023-07-26
Ubuntu
Kernel Live Patch Security Notice2023-07-25
CVE-2023-31248 (HIGH CVSS 7.8) | Linux Kernel nftables Use-After-Fre | cvebase.io