Strix
26.1K

CVE-2023-4004

HIGHCVSS 7.8/10EPSS 0.96%

Last modified

CVE-2023-4004 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.. EPSS estimates a 0.96% chance of exploitation in the next 30 days.

Description

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.96%

56.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LinuxLinux Kernel>= 5.6, < 5.10.188
LinuxLinux Kernel>= 5.11, < 5.15.123
LinuxLinux Kernel>= 5.16, < 6.1.42
LinuxLinux Kernel>= 6.2, < 6.4.7
FedoraprojectFedora38
RedhatEnterprise Linux8.0
RedhatEnterprise Linux9.0
NetappH300sAll versions
NetappH410sAll versions
NetappH500sAll versions
NetappH700sAll versions
DebianDebian Linux10.0
DebianDebian Linux11.0
DebianDebian Linux12.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-4004?
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
How severe is CVE-2023-4004?
CVE-2023-4004 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.96% probability of exploitation in the next 30 days.
How do I fix CVE-2023-4004?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-4004?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST