CVE-2023-6040

Published: 12 January 2024

An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.

From the Ubuntu Security Team

Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

Notes

CWE-125

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
    sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
    echo kernel.unprivileged_userns_clone=0 | \
    sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2024/01/12/1
• https://ubuntu.com/security/notices/USN-6605-1
• https://ubuntu.com/security/notices/USN-6607-1
• https://ubuntu.com/security/notices/USN-6609-1
• https://ubuntu.com/security/notices/USN-6605-2
• https://ubuntu.com/security/notices/USN-6609-2
• https://ubuntu.com/security/notices/USN-6609-3
• https://ubuntu.com/security/notices/USN-6628-1
• https://ubuntu.com/security/notices/USN-6628-2
• https://www.cve.org/CVERecord?id=CVE-2023-6040
• NVD
• Launchpad
• Debian