Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2023-3390

Description

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.

POC

Reference

- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html

Github

- https://github.com/c0m0r1/c0m0r1

- https://github.com/fkie-cad/nvd-json-data-feeds

- https://github.com/flygonty/CVE-2023-3390_PoC

- https://github.com/leesh3288/leesh3288

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/pawan-shivarkar/pawan-shivarkar

- https://github.com/xairy/linux-kernel-exploitation