CVE-2023-32233

NameCVE-2023-32233
DescriptionIn the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3446-1, DLA-3508-1, DSA-5402-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bullseye5.10.218-1fixed
bullseye (security)5.10.221-1fixed
bookworm6.1.94-1fixed
bookworm (security)6.1.99-1fixed
trixie6.9.9-1fixed
sid6.9.10-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebuster4.19.289-1DLA-3508-1
linuxsourcebullseye5.10.179-1DSA-5402-1
linuxsource(unstable)6.1.27-1
linux-5.10sourcebuster5.10.179-1~deb10u1DLA-3446-1

Notes

https://www.openwall.com/lists/oss-security/2023/05/08/4
https://git.kernel.org/linus/c1592a89942e9678f7d9c8030efa777c0d57edab (6.4-rc1)
https://www.openwall.com/lists/oss-security/2023/05/15/5

Search for package or bug name: Reporting problems