CVE-2023-32233
- State
- Published
- Severity
- 7.8 High
- Published
- May 8, 2023
- Updated
- Oct 14, 2026
- Reserved
- May 5, 2023
Description
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.openwall.com/lists/oss-security/2023/05/08/4
- https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edab
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1592a89942e9678f7d9c8030efa777c0d57edab
- https://news.ycombinator.com/item?id=35879660
- https://bugzilla.redhat.com/show_bug.cgi?id=2196105
- DSA-5402vendor-advisory
- [oss-security] 20230515 Re: [CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memorymailing-list
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security updatemailing-list
- https://security.netapp.com/advisory/ntap-20230616-0002/
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- [debian-lts-announce] 20230727 [SECURITY] [DLA 3508-1] linux security updatemailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.