CVE-2023-4128
Published: 10 August 2023
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
From the Ubuntu Security Team
It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
Mitigation
If not needed, disable the ability for unprivileged users to create namespaces. To do this temporarily, do: sudo sysctl -w kernel.unprivileged_userns_clone=0 To disable across reboots, do: echo kernel.unprivileged_userns_clone=0 | \ sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf
Rejected
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.8 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
- https://git.kernel.org/linus/3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 (6.5-rc5)
- https://git.kernel.org/linus/76e42ae831991c828cffa8c37736ebfb831ad5ec (6.5-rc5)
- https://git.kernel.org/linus/b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 (6.5-rc5)
- https://lore.kernel.org/netdev/193d6cdf-d6c9-f9be-c36a-b2a7551d5fb6@mojatatu.com/
- https://access.redhat.com/security/cve/CVE-2023-4128
- https://ubuntu.com/security/notices/USN-6343-1
- https://ubuntu.com/security/notices/USN-6383-1
- https://ubuntu.com/security/notices/USN-6385-1
- https://ubuntu.com/security/notices/USN-6386-1
- https://ubuntu.com/security/notices/USN-6387-1
- https://ubuntu.com/security/notices/USN-6388-1
- https://ubuntu.com/security/notices/USN-6396-1
- https://ubuntu.com/security/notices/USN-6387-2
- https://ubuntu.com/security/notices/USN-6386-2
- https://ubuntu.com/security/notices/USN-6386-3
- https://ubuntu.com/security/notices/USN-6396-2
- https://ubuntu.com/security/notices/USN-6396-3
- https://ubuntu.com/security/notices/USN-6466-1
- https://www.cve.org/CVERecord?id=CVE-2023-4128
- NVD
- Launchpad
- Debian