CVE-2023-52433 netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
A use-after-free in the Linux kernel netfilter rbtree implementation allows attackers to cause denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52433?
CVE-2023-52433 is a high-severity use after free vulnerability in Linux kernel, published on 20 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
Weakness: CWE-273
Which versions are affected by CVE-2023-52433?
It affects 2 products.
Products include Linux kernel, Netapp Ontap Tools.
How do I fix CVE-2023-52433?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-52433 being exploited?
There is no known exploitation of CVE-2023-52433 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52433, DEBIAN-CVE-2023-52433, GHSA-cmph-x6r4-4whr, UBUNTU-CVE-2023-52433.