A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade perfUpgrade bpftoolUpgrade python3-perfUpgrade kernel-develUpgrade kernel-zfcpdump-devel | Nov 28, 2023 | Sep 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.186-179.751Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.320-243.544Upgrade kernelUpgrade kernel-livepatch-5.10.192-182.736Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.186-179.751-debuginfoUpgrade kernel-livepatch-4.14.320-243.544-debuginfoUpgrade kernel-livepatch-5.15.128-80.144Upgrade python-perf-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-4.14.322-244.536 | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux | — | Upgrade kernel | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade perfUpgrade bpftoolUpgrade kernel-tools | Feb 17, 2025 | Jul 29, 2023 |
| Centos_linux | — | Upgrade kpatch-patch-3_10_0-1160_95_1-debuginfoUpgrade kernel-rtUpgrade kpatch-patch-3_10_0-1160_102_1Upgrade kpatch-patch-3_10_0-1160_90_1Upgrade kpatch-patch-3_10_0-1160_99_1Upgrade kpatch-patch-3_10_0-1160_95_1Upgrade kernelUpgrade kpatch-patch-3_10_0-1160_92_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_102_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_99_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_90_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_92_1 | Nov 8, 2023 | Sep 6, 2023 |
| Debian | — | Upgrade linux | Sep 11, 2023 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel | Jan 10, 2024 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade perfUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-libsUpgrade python-perfUpgrade kernel-tools | Feb 12, 2024 | Sep 6, 2023 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 3, 2023 | Jul 29, 2023 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 8, 2023 | Sep 6, 2023 |
| Ubuntu | — | Upgrade linux-oem-6.1Upgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.4Upgrade linuxUpgrade linux-gcp-fipsUpgrade linux-nvidia-tegraUpgrade linux-hwe-6.2Upgrade linux-azure-4.15Upgrade linux-awsUpgrade linux-aws-5.15Upgrade linux-raspi-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-lts-xenialUpgrade linux-hweUpgrade linux-azure-5.4Upgrade linux-oracle-5.4Upgrade linux-bluefieldUpgrade linux-gkeop-5.15Upgrade linux-gcp-4.15Upgrade linux-lowlatency-hwe-6.2Upgrade linux-iotUpgrade linux-hwe-5.15Upgrade linux-gcp-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-azure-fipsUpgrade linux-xilinx-zynqmpUpgrade linux-gcpUpgrade linux-azure-fdeUpgrade linux-riscvUpgrade linux-raspiUpgrade linux-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-lowlatencyUpgrade linux-hwe-5.4Upgrade linux-starfiveUpgrade linux-gkeopUpgrade linux-azure-5.15Upgrade linux-azure-6.2Upgrade linux-aws-hweUpgrade linux-azureUpgrade linux-ibmUpgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-aws-6.2Upgrade linux-gkeUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-azure-fde-6.2Upgrade linux-aws-5.4Upgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-gcp-6.2Upgrade linux-ibm-5.15Upgrade linux-nvidia | Nov 19, 2024 | Sep 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub