linux-cve-announce - CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123034-CVE-2023-54243-5fb8@gregkh>
Date: Tue, 30 Dec 2025 13:14:13 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix table blob use-after-free

We are not allowed to return an error at this point.
Looking at the code it looks like ret is always 0 at this
point, but its not.

t = find_table_lock(net, repl->name, &ret, &ebt_mutex);

... this can return a valid table, with ret != 0.

This bug causes update of table->private with the new
blob, but then frees the blob right away in the caller.

Syzbot report:

BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74
Workqueue: netns cleanup_net
Call Trace:
 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517
 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372
 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169
 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613
...

ip(6)tables appears to be ok (ret should be 0 at this point) but make
this more obvious.

The Linux kernel CVE team has assigned CVE-2023-54243 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.15 with commit c58dd2dd443c26d856a168db108a0cd11c285bf3 and fixed in 5.10.173 with commit 9060abce3305ab2354c892c09d5689df51486df5
	Issue introduced in 3.15 with commit c58dd2dd443c26d856a168db108a0cd11c285bf3 and fixed in 5.15.100 with commit dbb3cbbf03b3c52cb390fabec357f1e4638004f5
	Issue introduced in 3.15 with commit c58dd2dd443c26d856a168db108a0cd11c285bf3 and fixed in 6.1.18 with commit 3dd6ac973351308d4117eda32298a9f1d68764fd
	Issue introduced in 3.15 with commit c58dd2dd443c26d856a168db108a0cd11c285bf3 and fixed in 6.2.5 with commit cda0e0243bd3c04008fcd37a46b0269fb3c49249
	Issue introduced in 3.15 with commit c58dd2dd443c26d856a168db108a0cd11c285bf3 and fixed in 6.3 with commit e58a171d35e32e6e8c37cfe0e8a94406732a331f
	Issue introduced in 3.2.60 with commit a3bc0f8ea439762aa62d40a295157410498cbea7
	Issue introduced in 3.4.91 with commit 8ed40c122919cd79bc3c059e5864e5e7d9d455f0
	Issue introduced in 3.10.41 with commit c5e4ef499cfc78de45a4f01b8c557b5964d77c53
	Issue introduced in 3.12.21 with commit f34728610b2a8c7b9864f9404f2884c17f6fca5c
	Issue introduced in 3.14.5 with commit 8b5740915a9faa8b1fa9166193a33e2a9ae30ec6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54243
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bridge/netfilter/ebtables.c
	net/ipv4/netfilter/ip_tables.c
	net/ipv6/netfilter/ip6_tables.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9060abce3305ab2354c892c09d5689df51486df5
	https://git.kernel.org/stable/c/dbb3cbbf03b3c52cb390fabec357f1e4638004f5
	https://git.kernel.org/stable/c/3dd6ac973351308d4117eda32298a9f1d68764fd
	https://git.kernel.org/stable/c/cda0e0243bd3c04008fcd37a46b0269fb3c49249
	https://git.kernel.org/stable/c/e58a171d35e32e6e8c37cfe0e8a94406732a331f