Описание
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
An out-of-bounds (OOB) memory access flaw was found in the Netfilter module in the Linux kernel's nft_byteorder_eval in net/netfilter/nft_byteorder.c. A bound check failure allows a local attacker with CAP_NET_ADMIN access to cause a local privilege escalation issue due to incorrect data alignment.
Отчет
Exploiting this flaw will require the CAP_NET_ADMIN access privilege in any user or network namespace.
Меры по смягчению последствий
To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the kernel netfilter module. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fixed | RHSA-2023:5621 | 10.10.2023 |
| Red Hat Enterprise Linux 7 | kpatch-patch | Fixed | RHSA-2023:5574 | 10.10.2023 |
| Red Hat Enterprise Linux 7 | kernel | Fixed | RHSA-2023:5622 | 10.10.2023 |
| Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118) | kernel | Fixed | RHSA-2023:5414 | 03.10.2023 |
| Red Hat Enterprise Linux 7.7 Advanced Update Support | kernel | Fixed | RHSA-2023:7243 | 15.11.2023 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2023:5255 | 19.09.2023 |
| Red Hat Enterprise Linux 8 | kpatch-patch | Fixed | RHSA-2023:5221 | 19.09.2023 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2023:5244 | 19.09.2023 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | kpatch-patch | Fixed | RHSA-2023:5235 | 19.09.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byte ...
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
Уязвимость функции nft_byteorder_eval() в модуле net/netfilter/nft_byteorder.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
7.8 High
CVSS3