CVE-2023-42756

Summary

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of __ip_set_put on a wrong set. This issue may allow a local user to crash the system.

Affected Software

Weaknesses

• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CVE Program Container

Additional References

• https://access.redhat.com/errata/RHSA-2024:2394
• https://access.redhat.com/security/cve/CVE-2023-42756
• https://bugzilla.redhat.com/show_bug.cgi?id=2239848
• https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/
• https://seclists.org/oss-sec/2023/q3/242

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://access.redhat.com/errata/RHSA-2024:2394
• https://access.redhat.com/security/cve/CVE-2023-42756
• https://bugzilla.redhat.com/show_bug.cgi?id=2239848
• https://seclists.org/oss-sec/2023/q3/242

• ←Previous
• Next→