PT-2023-6959 · Linux+4 · Linux Kernel+4

Lonial Kong · Published 2023-11-08 · Updated 2025-03-20 · CVE-2023-6111

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free vulnerability in the Linux kernel's netfilter: nf tables component can be exploited to achieve local privilege escalation. The function nft trans gc catchall did not remove the catchall set element from the catchall list when the argument sync is true, making it possible to free a catchall set element many times.

Recommendations Upgrade past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 to resolve the issue. As a temporary workaround, consider restricting access to the nft trans gc catchall function until a patch is available.

Exploit

Fix

LPE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2024-10855

ALT-PU-2024-1867

AZL-32122

AZL-34865

BDU:2023-07978

CVE-2023-6111

USN-6576-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 41

• 🔥 https://github.com/google/security-research/tree/master/pocs/linux/kernelctf · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3S55P23EYAWDHXZPJEVTGIRZZRICYI3Z · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-6111 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 · Patch
• https://ubuntu.com/security/notices/USN-6576-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6111 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-6111 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3OXWBKK7RTQOGGDLQGCZFS753VLGS2GD · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6111 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IG6IF3FUY7LVZJMFRPANAU4L4PSJ3ESQ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6111 · Vendor Advisory
• https://kernel.dance/93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6111 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-6111 · Vendor Advisory