Updated: 2024-02-05 19:59:00.536134
Description:
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.
Links | NIST | CIRCL | RHEL | Ubuntu |
Severity | Score | |
---|---|---|
CVSS Version 2.x | 0 | |
CVSS Version 3.x | HIGH | 7.8 |
OS name | Project name | Version | Score | Severity | Status | Errata | Last updated |
---|---|---|---|---|---|---|---|
AlmaLinux 9.2 ESU | kernel | 5.14.0 | 7.8 | HIGH | Released | CLSA-2024:1712263970 | 2024-04-07 09:57:01 |
AlmaLinux 9.2 FIPS | kernel | 5.14.0 | 7.8 | HIGH | Released | CLSA-2024:1712570434 | 2024-04-08 10:43:29 |
CentOS 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-09-29 05:08:34 | |
CentOS 7 ELS | kernel | 3.10.0 | 7.8 | HIGH | Already Fixed | 2024-03-16 04:43:27 | |
CentOS 8.4 ELS | kernel | 4.18.0 | 7.8 | HIGH | Released | 2024-01-15 13:14:21 | |
CentOS 8.5 ELS | kernel | 4.18.0 | 7.8 | HIGH | Released | 2024-01-19 10:14:19 | |
CentOS Stream 8 ELS | kernel | 4.18.0 | 7.8 | HIGH | Already Fixed | 2024-06-29 10:08:34 | |
CloudLinux 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-09-22 09:30:04 | |
CloudLinux 7 ELS | kernel | 3.10.0 | 7.8 | HIGH | In Testing | 2024-10-24 00:59:02 | |
Oracle Linux 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-09-29 05:08:34 |