PT-2023-3559
CVE-2023-35001
·
تاريخ النشر
2023-07-04
·
تاريخ التحديث
2026-10-21
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions prior to 5.19.0-35
Description
The issue is related to the
nft byteorder function in the Linux Kernel's netfilter subsystem, which poorly handles vm register contents when CAP NET ADMIN is in any user or network namespace. This can lead to an out-of-bounds read/write operation, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability was exploited at Pwn2Own Vancouver 2023 on Ubuntu desktop, where the exploit supported the kernel version available at the beginning of the event.Recommendations
For Linux Kernel versions prior to 5.19.0-35, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the
nft byteorder function until a patch is available. Avoid using the nft byteorder function in sensitive operations until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾