Vulnerability · Published Jul 31, 2023 · Assigned by redhat

CVE-2023-4004Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bpftool	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	bpftool	7.0.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-devel-matched	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-modules	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-modules-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-debug-modules-extra	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-devel-matched	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-modules	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-modules-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-64k-modules-extra	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-abi-stablelists	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-abi-stablelists	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-core	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-cross-headers	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:8	kernel-debug	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-debug	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-debug-core	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-debug-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-debug-devel	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-debug-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-debug-devel-matched	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-debug-modules	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-debug-modules	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-debug-modules-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-debug-modules-extra	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-debug-modules-extra	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-debug-uki-virt	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-devel	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-devel-matched	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-doc	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:8	kernel-headers	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:8	kernel-modules	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-modules	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-modules-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-modules-extra	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-modules-extra	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-rt	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-core	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-core	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-devel	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-kvm	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-modules	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-modules-core	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-debug-modules-extra	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-devel	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-kvm	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-modules	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-modules-core	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:9	kernel-rt-modules-extra	5.14.0-284.30.1.rt14.315.el9_2	ALSA-2023:5091
AlmaLinux:8	kernel-tools	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-tools	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-tools-libs	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-tools-libs	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-tools-libs-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-uki-virt	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-zfcpdump	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-zfcpdump	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-zfcpdump-core	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-zfcpdump-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-zfcpdump-devel	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-zfcpdump-devel	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-zfcpdump-devel-matched	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-zfcpdump-modules	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-zfcpdump-modules	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	kernel-zfcpdump-modules-core	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	kernel-zfcpdump-modules-extra	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	kernel-zfcpdump-modules-extra	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	perf	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	perf	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:8	python3-perf	4.18.0-477.27.2.el8_8	ALSA-2023:5244
AlmaLinux:9	python3-perf	5.14.0-284.30.1.el9_2	ALSA-2023:5069
AlmaLinux:9	rtla	5.14.0-284.30.1.el9_2	ALSA-2023:5069
Debian:12	linux	6.1.52-1	DEBIAN-CVE-2023-4004
Debian:12	linux	6.1.52-1	DSA-5492-1
Debian:13	linux	6.4.11-1	DEBIAN-CVE-2023-4004
Debian:14	linux	6.4.11-1	DEBIAN-CVE-2023-4004
Rocky Linux:8	kernel	0:4.18.0-477.27.1.el8_8.cloud	RXSA-2023:5244
Rocky Linux:8	kernel	0:4.18.0-477.27.1.el8_8	RLSA-2023:5244
Rocky Linux:9	kernel-rt	0:5.14.0-284.30.1.rt14.315.el9_2	RLSA-2023:5091
Ubuntu:22.04:LTS	linux	5.15.0-82.91	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux	5.15.0-82.91	USN-6315-1
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-aws	5.15.0-1043.48	USN-6315-1
Ubuntu:22.04:LTS	linux-aws	5.15.0-1043.48	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1010.10~22.04.1	USN-6318-1
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1010.10~22.04.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-azure	5.15.0-1045.52	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-azure	5.15.0-1045.52	USN-6332-1
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1011.11~22.04.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1045.52.1	USN-6332-1
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1045.52.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1040.48	USN-6315-1
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1040.48	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1012.12~22.04.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gke	5.15.0-1040.45	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gke	5.15.0-1040.45	USN-6315-1
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1026.31	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1026.31	USN-6315-1
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-31.31~22.04.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-31.31~22.04.1	USN-6318-1
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1036.39	USN-6315-1
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1036.39	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1038.43	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1038.43	USN-6325-1
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1040.45	USN-6315-1
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1040.45	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-82.91	USN-6315-1
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-82.91	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1011.11~22.04.1	USN-6318-1
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1011.11~22.04.1	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1031.31	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1031.31	USN-6315-1
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1010.10	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1017.17	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1004.4	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-oem-6.0	6.0.0-1021.21	USN-6385-1
Ubuntu:22.04:LTS	linux-oem-6.0	6.0.0-1021.21	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1020.20	USN-6316-1
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1020.20	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1041.47	USN-6315-1
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1041.47	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1036.39	USN-6348-1
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1036.39	UBUNTU-CVE-2023-4004
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2023-4004
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1025.29	UBUNTU-CVE-2023-4004

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2023:4961 vendor-advisory, x_refsource_REDHAT
RHSA-2023:4962 vendor-advisory, x_refsource_REDHAT
RHSA-2023:4967 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5069 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5091 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5093 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5221 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5244 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5255 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5548 vendor-advisory, x_refsource_REDHAT
RHSA-2023:5627 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7382 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7389 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7411 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7417 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7431 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7434 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-4004 vdb-entry, x_refsource_REDHAT
RHBZ#2225275 issue-tracking, x_refsource_REDHAT
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/
http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html x_transferred
http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html x_transferred
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html x_transferred
https://security.netapp.com/advisory/ntap-20231027-0001/ x_transferred
https://www.debian.org/security/2023/dsa-5480 x_transferred
https://www.debian.org/security/2023/dsa-5492 x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-831302.html
https://cert-portal.siemens.com/productcert/html/ssa-794697.html