PT-2023-2383 · Linux+10 · Linux Kernel+10
Valis
·
Publicado
2023-02-16
·
Atualizado
2025-10-08
·
CVE-2023-1829
CVSS v3.1
8.1
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Linux Kernel (affected versions not specified)
Description
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The
tcindex delete function does not properly deactivate filters in case of a perfect hash while deleting the underlying structure, which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate their privileges to root.Recommendations
Upgrade past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 to resolve the issue. As a temporary workaround, consider disabling the
tcindex delete function until a patch is available. Restrict access to the vulnerable tcindex filter to minimize the risk of exploitation. Avoid using the tcindex filter in the affected API endpoints until the issue is resolved.Exploit
Correção
DoS
LPE
Double Free
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Linux Kernel
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu