Bug 1217164 (CVE-2023-6111)

Summary:	VUL-0: CVE-2023-6111: kernel-source,kernel-source-azure,kernel-source-rt: use-after-free vulnerability in nf_tables
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	jack, jlee, mhocko, mkubecek, thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/384856/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-6111:7.8:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-11-15 09:11:26 UTC

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables
component can be exploited to achieve local privilege escalation.

The function nft_trans_gc_catchall did not remove the catchall set element from
the catchall_list when the argument sync is true, making it possible to free a
catchall set element many times.

We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630.



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6111

Comment 1 Thomas Leroy 2023-11-15 09:15:03 UTC

Only stable branch contains the buggy commit, but it doesn't have the fixing one

Comment 3 Joey Lee 2023-11-20 06:37:42 UTC

The patch is in v6.7:

commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Nov 6 10:53:09 2023 +0100

    netfilter: nf_tables: remove catchall element in GC sync path

    The expired catchall element is not deactivated and removed from GC sync
    path. This path holds mutex so just call nft_setelem_data_deactivate()
    and nft_setelem_catchall_remove() before queueing the GC work.

    Fixes: 4a9e12ea7e70 ("netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC")
    Reported-by: lonial con <kongln9170@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Comment 4 Joey Lee 2023-11-20 06:38:57 UTC

I think that we can wait the v6.7 be pushed to stable branch.

Comment 7 Jan Kara 2023-12-18 17:13:44 UTC

The fix has landed in upstream stable kernel in 6.6.3 which is in our stable branch. So all should be done, reassigning back to the security team.

Comment 8 Andrea Mattiazzo 2024-05-31 13:06:16 UTC

All done, closing.