A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-perfUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade perfUpgrade bpftoolUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-docUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extra | Nov 28, 2023 | Sep 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-toolsUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-livepatch-5.10.186-179.751Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-livepatch-4.14.320-243.544Upgrade kernel-livepatch-4.14.322-244.536Upgrade kernel-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.192-182.736Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.128-80.144Upgrade kernel-livepatch-5.10.186-179.751-debuginfoUpgrade kernel-livepatch-4.14.320-243.544-debuginfo | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux | — | Upgrade kernel | Oct 4, 2023 | Sep 6, 2023 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade python3-perf-debuginfoUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-libbpf | Feb 17, 2025 | Jul 29, 2023 |
| Centos_linux | — | Upgrade kpatch-patch-3_10_0-1160_102_1Upgrade kernel-rtUpgrade kpatch-patch-3_10_0-1160_95_1Upgrade kpatch-patch-3_10_0-1160_90_1Upgrade kpatch-patch-3_10_0-1160_99_1Upgrade kpatch-patch-3_10_0-1160_95_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_92_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_102_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_99_1-debuginfoUpgrade kernelUpgrade kpatch-patch-3_10_0-1160_90_1-debuginfoUpgrade kpatch-patch-3_10_0-1160_92_1 | Nov 8, 2023 | Sep 6, 2023 |
| Debian | — | Upgrade linux | Sep 11, 2023 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel | Jan 10, 2024 | Sep 6, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade perfUpgrade kernel-headersUpgrade kernel-devel | Feb 12, 2024 | Sep 6, 2023 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 3, 2023 | Jul 29, 2023 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 8, 2023 | Sep 6, 2023 |
| Ubuntu | — | Upgrade linux-azure-fdeUpgrade linux-xilinx-zynqmpUpgrade linux-gcpUpgrade linux-azure-fipsUpgrade linux-nvidiaUpgrade linux-aws-5.4Upgrade linux-riscvUpgrade linux-realtimeUpgrade linux-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-hwe-5.4Upgrade linux-gcp-5.15Upgrade linux-starfiveUpgrade linux-raspiUpgrade linux-gkeopUpgrade linux-azure-fde-6.2Upgrade linux-gkeUpgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linux-azure-6.2Upgrade linux-intel-iot-realtimeUpgrade linux-azureUpgrade linux-ibm-5.15Upgrade linux-riscv-5.15Upgrade linux-intel-iotgUpgrade linux-azure-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-lowlatencyUpgrade linux-aws-6.2Upgrade linux-aws-hweUpgrade linux-gcp-6.2Upgrade linux-aws-fipsUpgrade linux-hwe-6.2Upgrade linux-azure-4.15Upgrade linux-awsUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegraUpgrade linux-oem-6.1Upgrade linux-gcp-4.15Upgrade linux-hwe-5.15Upgrade linux-hweUpgrade linux-lts-xenialUpgrade linux-oracle-5.4Upgrade linux-iotUpgrade linux-gkeop-5.15Upgrade linux-bluefieldUpgrade linux-ibm-5.4Upgrade linux-raspi-5.4Upgrade linux-lowlatency-hwe-6.2Upgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.4Upgrade linuxUpgrade linux-gcp-fipsUpgrade linux-azure-5.4 | Nov 19, 2024 | Sep 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub