CVE-2023-54200

A flaw was found in the Linux kernel's netfilter component. When a virtual Ethernet (veth) device is released, the associated network namespace (netns) device memory may be prematurely freed. This can lead to a use-after-free vulnerability during the unregistration of netdev hooks. A local attacker with high privileges could exploit this flaw to cause a system crash, resulting in a denial of service.

A moderate use-after-free flaw was found in the Linux kernel's netfilter/nf_tables subsystem in Red Hat Enterprise Linux 8 (kernel and kernel-rt, across its update streams) and the Red Hat Enterprise Linux 9.0 and 9.2 update streams. When a virtual Ethernet (veth) device is released, the veth release callback also queues the peer network namespace's device for removal; if that peer network namespace is itself being torn down, the device memory can already be freed when the nf_tables pre_exit hook later unregisters the netdev hooks, resulting in a slab use-after-free during network namespace cleanup. A local attacker with the high privileges needed to configure network namespaces, veth devices, and nftables netdev hooks could exploit this flaw during namespace teardown to crash the kernel, resulting in a denial of service. Red Hat rates this flaw Moderate rather than the upstream CVEORG Important severity because exploitation requires a highly privileged local attacker, the attack complexity is high, and the practical consequence is limited to system availability. The fix for the affected Red Hat Enterprise Linux 8 and 9 streams is currently deferred to a future maintenance update, so the residual risk remains a local, privilege-gated denial of service triggered during network namespace teardown. Red Hat Enterprise Linux 6 and 7, the later Red Hat Enterprise Linux 9 update streams (9.4 onward), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.