CVE-2023-3390CWE-416

Use-after-free in Linux kernel's netfilter subsystem

High · published June 28, 2023

CVSS v3.1
7.8
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.

Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.

We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weakness
CWE-416 · Use After Free
Published
2023-06-28T20:02Z
EPSS history
Timeline
  • 28 JUN 20:02Z
    Use-after-free in Linux kernel's netfilter subsystem
    cvelistv5