CVE-2023-54243
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
Affected versions
Linux kernel versions
3.2.60,
3.4.91,
3.10.41,
3.12.21,
3.14.5,
3.15
and later are affected. Fixed in
5.10.173,
5.15.100,
6.1.18,
6.2.5,
6.3
and their respective stable series.
References
The following references provide additional information about CVE-2023-54243 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/3dd6ac973351308d4117eda32298a9f1d68764fd
-
PatchKernel patch commithttps://git.kernel.org/stable/c/9060abce3305ab2354c892c09d5689df51486df5
-
PatchKernel patch commithttps://git.kernel.org/stable/c/cda0e0243bd3c04008fcd37a46b0269fb3c49249
Frequently asked questions
-
What is CVE-2023-54243?
CVE-2023-54243 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.2.60 onward and has been patched in 5.10.173, 5.15.100, 6.1.18 and others. CVE-2023-54243 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54243?
Yes — CVE-2023-54243 has been patched. Fixed versions include 5.10.173, 5.15.100, 6.1.18 and others. If you are running Linux kernel 3.2.60 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54243 actively exploited?
No — CVE-2023-54243 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.