High · published July 22, 2023
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.
If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.14, < 4.14.322 | 4.14.322 |
| linux/linux_kernel | ≥ 4.15, < 4.19.291 | 4.19.291 |
| linux/linux_kernel | ≥ 4.20, < 5.4.248 | 5.4.248 |
| linux/linux_kernel | ≥ 5.5, < 5.10.185 | 5.10.185 |
| linux/linux_kernel | ≥ 5.11, < 5.15.118 | 5.15.118 |
| linux/linux_kernel | ≥ 5.16, < 6.1.35 | 6.1.35 |
| linux/linux_kernel | ≥ 6.2, < 6.3.9 | 6.3.9 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |