Skip to content

Latest commit

 

History

History
92 lines (53 loc) · 2.49 KB

Advisory-EGI-SVG-2024-01.md

File metadata and controls

92 lines (53 loc) · 2.49 KB
Raw
title permalink redirect_from
Advisory-EGI-SVG-2024-01
/Advisory-EGI-SVG-2024-01
/Advisory-SVG-CVE-2023-4206
/Advisory-SVG-CVE-2023-4207
/Advisory-SVG-CVE-2023-4208

Advisory-EGI-SVG-2024-01

HIGH risk Linux Privilege Escalation Vulnerabilities

Use-after-free flaws was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. [R 1]

IDs AND CVSS SCORE

EGI SVG ID : EGI-SVG-2024-01

CVE ID : CVE-2023-4206, CVE-2023-4207, CVE-2023-4208

CVSS Score : 7.8 [R 1]

ACTIONS REQUIRED/RECOMMENDED

Sites are recommended to update relevant components as soon as possible, see references below, where patches are available.

MITIGATION

Potential mitigation is to prevent the module cls_u32 from being loaded by blacklisting the module to prevent it from loading automatically [R 1]

MORE INFORMATION

All relevant Linux versions appear to be affected, and most are patched

STATUS OF THIS ADVISORY

TLP:CLEAR information - Unlimited distribution

https://advisories.egi.eu/Advisory-EGI-SVG-2024-01

https://advisories.egi.eu/Advisory-SVG-CVE-2023-4206
https://advisories.egi.eu/Advisory-SVG-CVE-2023-4207
https://advisories.egi.eu/Advisory-SVG-CVE-2023-4208

Minor updates may be made without re-distribution to the sites.

CONTACT AND OTHER INFORMATION ON SVG

Comments or questions should be sent to svg-rat at mailman.egi.eu

Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu

(see [R 99] for further details, and other information on SVG)

REFERENCES