cve/2023/CVE-2023-3390.md

CVE-2023-3390

Description

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.

POC

Reference

• http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html

Github

• https://github.com/c0m0r1/c0m0r1
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/leesh3288/leesh3288
• https://github.com/tanjiti/sec_profile
• https://github.com/xairy/linux-kernel-exploitation