IT

Tracker / CVE-2023-53619

CVE-2023-53619

High 7.8

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini() clean-up path frees the nf_ct_helper_hash map. When built with NF_CONNTRACK=y, further netfilter modules (e.g: netfilter_conntrack_ftp) can still be loaded and call nf_conntrack_helpers_register(), independently of whether nf_conntrack initialized correctly. This accesses the nf_ct_helper_hash dangling pointer and causes a uaf, possibly leading to random memory corruption. This patch guards nf_conntrack_helper_register() from accessing a freed or uninitialized nf_ct_helper_hash pointer and fixes possible uses-after-free when loading a conntrack module.

Affected products and versions

linux linux_kernel
linux linux_kernel · 3.6 → 4.14.322
linux linux_kernel · 4.15 → 4.19.291
linux linux_kernel · 4.20 → 5.4.251
linux linux_kernel · 5.11 → 5.15.121
linux linux_kernel · 5.16 → 6.1.39
linux linux_kernel · 5.5 → 5.10.188
linux linux_kernel · 6.2 → 6.4.4

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References