CVE-2023-54243
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
How to fix
- Linux Linux9060abce3305ab2354c892c09d5689df51486df5, dbb3cbbf03b3c52cb390fabec357f1e4638004f5, 3dd6ac973351308d4117eda32298a9f1d68764fd, cda0e0243bd3c04008fcd37a46b0269fb3c49249, e58a171d35e32e6e8c37cfe0e8a94406732a331f, 3.3, 3.5, 3.11, 3.13, 3.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c58dd2dd443c26d856a168db108a0cd11c285bf3 ≤ v < 9060abce3305ab2354c892c09d5689df51486df5, c58dd2dd443c26d856a168db108a0cd11c285bf3 ≤ v < dbb3cbbf03b3c52cb390fabec357f1e4638004f5, c58dd2dd443c26d856a168db108a0cd11c285bf3 ≤ v < 3dd6ac973351308d4117eda32298a9f1d68764fd, c58dd2dd443c26d856a168db108a0cd11c285bf3 ≤ v < cda0e0243bd3c04008fcd37a46b0269fb3c49249, c58dd2dd443c26d856a168db108a0cd11c285bf3 ≤ v < e58a171d35e32e6e8c37cfe0e8a94406732a331f, a3bc0f8ea439762aa62d40a295157410498cbea7, 8ed40c122919cd79bc3c059e5864e5e7d9d455f0, c5e4ef499cfc78de45a4f01b8c557b5964d77c53, f34728610b2a8c7b9864f9404f2884c17f6fca5c, 8b5740915a9faa8b1fa9166193a33e2a9ae30ec6, 3.2.60 ≤ v < 3.3, 3.4.91 ≤ v < 3.5, 3.10.41 ≤ v < 3.11, 3.12.21 ≤ v < 3.13, 3.14.5 ≤ v < 3.15, 3.15 | 9060abce3305ab2354c892c09d5689df51486df5, dbb3cbbf03b3c52cb390fabec357f1e4638004f5, 3dd6ac973351308d4117eda32298a9f1d68764fd, cda0e0243bd3c04008fcd37a46b0269fb3c49249, e58a171d35e32e6e8c37cfe0e8a94406732a331f, 3.3, 3.5, 3.11, 3.13, 3.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.