CVE-2023-6817

Published: Dec 18, 2023Modified: Oct 14, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

Affected (8)

Products: Linux: Linux Kernel

1 product

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	5.11 ≤ version < 5.15.143
Linux Linux Kernel	5.16 ≤ version < 6.1.68
Linux Linux Kernel	5.6 ≤ version < 5.10.204
Linux Linux Kernel	6.2 ≤ version < 6.6.7
Linux Linux Kernel	Version 6.7 rc1
Linux Linux Kernel	Version 6.7 rc2
Linux Linux Kernel	Version 6.7 rc3
Linux Linux Kernel	Version 6.7 rc4

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (14)

http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html

Source: cve-coordination@google.com

http://www.openwall.com/lists/oss-security/2023/12/22/13

Source: cve-coordination@google.com

http://www.openwall.com/lists/oss-security/2023/12/22/6

Source: cve-coordination@google.com

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a

Source: cve-coordination@google.com

Mailing ListPatch

https://kernel.dance/317eb9685095678f2c9f5a8189de698c5354316a

Source: cve-coordination@google.com

Patch

https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html

Source: cve-coordination@google.com

http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2023/12/22/13

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2023/12/22/6

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://kernel.dance/317eb9685095678f2c9f5a8189de698c5354316a

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.