CVE-2023-4206
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
| Software | From | Fixed in |
|---|---|---|
| debian / debian_linux | 12.0 | 12.0.x |
| linux / linux_kernel | 4.15 | 4.19.291 |
| linux / linux_kernel | 6.2 | 6.4.10 |
| linux / linux_kernel | 5.16 | 6.1.45 |
| linux / linux_kernel | 5.11 | 5.15.126 |
| linux / linux_kernel | 5.5 | 5.10.190 |
| linux / linux_kernel | 4.20 | 5.4.253 |
| linux / linux_kernel | 3.18 | 4.14.322 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime