Linux Kernel net-sched net/sched/cls_u32.c tcf_change_indev use after free

Summaryinfo

A vulnerability was found in Linux Kernel. It has been classified as critical. Impacted is the function tcf_change_indev of the file net/sched/cls_u32.c of the component net-sched. The manipulation leads to use after free. This vulnerability is listed as CVE-2023-3609. The attack must be carried out locally. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel (Operating System) (unknown version). This issue affects the function tcf_change_indev of the file net/sched/cls_u32.c of the component net-sched. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

The weakness was presented 07/22/2023. It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2023-3609 since 07/10/2023. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 292751 (MiracleLinux 7 : kernel-3.10.0-1160.102.1.el7 (AXSA:2023-6501:28)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

The vulnerability is also documented in the databases at Tenable (292751) and CERT Bund (WID-SEC-2025-1293). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Ubuntu Linux
• IBM DataPower Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion