CVE-2023-54200

Vulnerability

A use-after-free vulnerability exists in the Linux kernel's netfilter subsystem, specifically in nf_tables. The bug arises when netdev events are skipped during network namespace (netns) removal due to a previous commit that was later reverted. This leads to a situation where device memory is freed before the netfilter hooks are properly unregistered, resulting in a slab-use-after-free condition [1][2].

Exploitation

An attacker capable of creating and destroying network namespaces, and managing veth devices (typically requiring root privileges or container-level access), can trigger the vulnerability. The sequence involves a veth device being released, which queues the peer netns device for removal. When the peer netns is also scheduled for removal, the device memory may be released before the pre_exit hook runs, causing a use-after-free when nf_hook_entry_head is accessed [1].

Impact

A successful exploit can cause a kernel crash (as evidenced by the KASAN report) and may potentially lead to privilege escalation or other memory corruption scenarios. The vulnerability is considered serious due to the use-after-free nature, which can be leveraged for arbitrary code execution [1][2].

Mitigation

The fix reverts the problematic commit that skipped netdev events on netns removal. Patches are available in the stable kernel tree (commit IDs dc1c9fd4a8bbe and 30e4b13b1bfbd). Users should update to the latest stable kernel versions that include this fix [1][2].