CVE-2023-32233High· 7.8▾ MidnightPoC availableIn the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges.…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 2.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
8 GitHub repos (last check)
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
linux_kernel >= 3.13, < 4.14.315linux_kernel >= 4.15, < 4.19.283linux_kernel >= 4.20, < 5.4.243linux_kernel >= 5.5, < 5.10.180linux_kernel >= 5.11, < 5.15.111linux_kernel >= 5.16, < 6.1.28linux_kernel >= 6.2, < 6.2.15linux_kernel >= 6.3, < 6.3.2enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0hci_baseboard_management_controller = h300shci_baseboard_management_controller = h410chci_baseboard_management_controller = h410shci_baseboard_management_controller = h500shci_baseboard_management_controller = h700sUpgrade past the affected range:
linux_kernel 6.3.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3141High· 7.1A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel
CVE-2022-41222High· 7.0mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
CVE-2023-5178High· 8.8A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel
CVE-2023-3338Medium· 6.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol
CVE-2023-26607High· 7.1In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
CVE-2023-0590Medium· 4.7A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem