CVE-2023-54035

Vulnerability

In the Linux kernel's netfilter subsystem, a reference counting bug exists in the nftables chain handling. When adding a set element fails, the error path decrements the chain reference counter twice: once during element release and again via nft_data_release(). This double decrement causes an underflow in the chain reference counter, potentially leading to use-after-free or other memory corruption issues [1].

Exploitation

An attacker with the ability to trigger set element addition failures in nftables (e.g., through crafted netlink messages or specific configuration) can exploit this double decrement. No special privileges beyond the ability to interact with nftables are required, though the attack surface is limited to local users with netfilter capabilities [1].

Impact

Successful exploitation could lead to a denial of service (kernel crash) or potentially arbitrary code execution if the freed chain structure is reallocated and used. The vulnerability affects systems running affected Linux kernel versions prior to the fix [1].

Mitigation

The fix is included in the Linux kernel stable tree as commit b068314fd8ce751a7f906e55bb90f3551815f1a0. Users should update their kernel to include this patch or apply the backport. No workaround is available [1].