A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediat…
Summary
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383f…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Lint boundary warnings (6)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://kernel.dance/04c55383fa5689357bcdd2c8036725a55ed632bc -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://kernel.dance/04c55383fa5689357bcdd2c8036725a55ed632bc
Sources
- NVD DATABASE
Original Links
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html Third Party Advisory
- http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bc Mailing List
- https://kernel.dance/04c55383fa5689357bcdd2c8036725a55ed632bc Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html Mailing List
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
- https://security.netapp.com/advisory/ntap-20230818-0005/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5480 Third Party Advisory
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html Third Party Advisory
- http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bc Mailing List
- https://kernel.dance/04c55383fa5689357bcdd2c8036725a55ed632bc Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html Mailing List
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
- https://security.netapp.com/advisory/ntap-20230818-0005/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5480 Third Party Advisory
Timeline
- nvd_ingest NVD