CVE - CVE-2023-1281

CVE-ID
CVE-2023-1281	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20230427-0004/ MISC:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2 URL:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2 MISC:https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2 URL:https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2 MLIST:[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update URL:https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html MLIST:[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update URL:https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html MLIST:[oss-security] 20230412 CVE-2023-1281, CVE-2023-1829: Linux kernel: Vulnerabilities in the tcindex classifier URL:http://www.openwall.com/lists/oss-security/2023/04/11/3
Assigning CNA
Google LLC
Date Record Created
20230308	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230308)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)