CVE-2023-32233High· 7.8▾ MidnightPoC availableIn the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges.…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 2.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
13% → 13%
7 GitHub repos (last check)
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
linux_kernel >= 3.13, < 4.14.315linux_kernel >= 4.15, < 4.19.283linux_kernel >= 4.20, < 5.4.243linux_kernel >= 5.5, < 5.10.180linux_kernel >= 5.11, < 5.15.111linux_kernel >= 5.16, < 6.1.28linux_kernel >= 6.2, < 6.2.15linux_kernel >= 6.3, < 6.3.2enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0hci_baseboard_management_controller = h300shci_baseboard_management_controller = h410chci_baseboard_management_controller = h410shci_baseboard_management_controller = h500shci_baseboard_management_controller = h700sUpgrade past the affected range:
linux_kernel 6.3.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3141High· 7.1A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel
CVE-2023-3338Medium· 6.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol
CVE-2022-41222High· 7.0mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
CVE-2023-26607High· 7.1In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
CVE-2023-5178High· 8.8A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel
CVE-2023-23559High· 7.8In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.