A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-modulesUpgrade kernel-docUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-develUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libs-develUpgrade kernel-debugUpgrade python3-perf | Nov 28, 2023 | Sep 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-livepatch-5.10.186-179.751Upgrade kernel-toolsUpgrade kernel-develUpgrade perfUpgrade bpftoolUpgrade kernel-livepatch-5.10.186-179.751-debuginfoUpgrade kernel-livepatch-4.14.322-244.536Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.320-243.544Upgrade kernelUpgrade kernel-livepatch-4.14.320-243.544-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.192-182.736Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.128-80.144 | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux | — | Upgrade kernel | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.49-69.116Upgrade perf-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools | Feb 17, 2025 | Jul 29, 2023 |
| Centos_linux | — | Upgrade kpatch-patch-3_10_0-1160_102_1Upgrade kpatch-patch-3_10_0-1160_99_1Upgrade kpatch-patch-3_10_0-1160_95_1Upgrade kernel-rtUpgrade kpatch-patch-3_10_0-1160_90_1Upgrade kpatch-patch-3_10_0-1160_95_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_90_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_102_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_99_1-debuginfoUpgrade kernelUpgrade kpatch-patch-3_10_0-1160_92_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_92_1 | Nov 8, 2023 | Sep 6, 2023 |
| Debian | — | Upgrade linux | Sep 11, 2023 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Jan 10, 2024 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade kernel-develUpgrade perfUpgrade kernelUpgrade kernel-tools-libsUpgrade python-perfUpgrade kernel-tools | Feb 12, 2024 | Sep 6, 2023 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 3, 2023 | Jul 29, 2023 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Nov 8, 2023 | Sep 6, 2023 |
| Ubuntu | — | Upgrade linux-azure-fdeUpgrade linux-riscv-5.15Upgrade linux-azure-fipsUpgrade linux-xilinx-zynqmpUpgrade linux-gcpUpgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-riscvUpgrade linux-raspiUpgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-realtimeUpgrade linux-azure-5.15Upgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gcp-6.2Upgrade linux-kvmUpgrade linux-lowlatencyUpgrade linux-ibm-5.15Upgrade linux-aws-hweUpgrade linux-aws-6.2Upgrade linux-gkeUpgrade linux-starfiveUpgrade linux-gkeopUpgrade linux-azure-6.2Upgrade linux-azure-fde-6.2Upgrade linux-nvidia-tegra-igxUpgrade linux-oracle-5.15Upgrade linux-aws-5.4Upgrade linux-aws-fipsUpgrade linux-fipsUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-oem-6.1Upgrade linux-awsUpgrade linux-iotUpgrade linux-gcp-4.15Upgrade linux-azure-5.4Upgrade linux-hweUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-4.15Upgrade linux-oracle-5.4Upgrade linux-hwe-5.15Upgrade linux-lowlatency-hwe-6.2Upgrade linux-nvidia-tegraUpgrade linux-gcp-5.4Upgrade linux-bluefieldUpgrade linux-gkeop-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-lts-xenialUpgrade linux-raspi-5.4Upgrade linux-aws-5.15Upgrade linux-ibm-5.4Upgrade linux-gcp-fipsUpgrade linuxUpgrade linux-hwe-6.2 | Nov 19, 2024 | Sep 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub