CVE-2023-4207
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.
When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.
| Software | From | Fixed in |
|---|---|---|
| debian / debian_linux | 12.0 | 12.0.x |
| linux / linux_kernel | 6.2 | 6.4.10 |
| linux / linux_kernel | 5.16 | 6.1.45 |
| linux / linux_kernel | 5.11 | 5.15.126 |
| linux / linux_kernel | 5.5 | 5.10.190 |
| linux / linux_kernel | 4.20 | 5.4.253 |
| linux / linux_kernel | 4.15 | 4.19.295 |
| linux / linux_kernel | 3.18 | 4.14.326 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime