CVE-2023-4569 Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c

Medium 5.5 Published 28 Aug 2023 Updated 27 Feb 2025

A local attacker can trigger double-deactivations in the Linux kernel netfilter subsystem, causing a memory leak and potential denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-4569?

CVE-2023-4569 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 28 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.

Weakness: CWE-401, CWE-402

Which versions are affected by CVE-2023-4569?

It affects 3 products.

Products include Debian Debian Linux, Linux kernel, Redhat Enterprise Linux.

How do I fix CVE-2023-4569?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-4569 being exploited?

There is no known exploitation of CVE-2023-4569 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-28545, CVE-2023-4621, DEBIAN-CVE-2023-4569, GHSA-2hgr-q34g-9rrw, ROOT-OS-DEBIAN-11-CVE-2023-4569, UBUNTU-CVE-2023-4569.