CVE-2023-4881

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.

From the Ubuntu Security Team

Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate register length, leading to an out-of- bounds write vulnerability. A local attacker could possibly use this to cause a denial of service (system crash).

Read the notes from the security team

Why is this CVE high priority?

By using unprivileged user namespaces, this can be exploited to achieve denial of service.

Learn more about Ubuntu priority

Status

Show unmaintained releases

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

rodrigo-zaiden

ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by 49499c3, fixed by fd94d9d Introduced by 935b7f6, fixed by fd94d9d Introduced by 133dc20, fixed by fd94d9d Introduced by dbb5281, fixed by fd94d9d

Severity score breakdown

Parameter	Value
Base score	7.1 · High
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-6439-1
Linux kernel vulnerabilities
19 October 2023

USN-6440-1
Linux kernel vulnerabilities
19 October 2023

USN-6441-1
Linux kernel vulnerabilities
19 October 2023

USN-6442-1
Linux kernel (BlueField) vulnerabilities
19 October 2023

USN-6443-1
Linux kernel (OEM) vulnerabilities
19 October 2023

USN-6444-1
Linux kernel vulnerabilities
19 October 2023

USN-6445-1
Linux kernel (Intel IoTG) vulnerabilities
19 October 2023

USN-6446-1
Linux kernel vulnerabilities
20 October 2023

USN-6440-2
Linux kernel (Azure) vulnerabilities
20 October 2023

USN-6439-2
Linux kernel (AWS) vulnerabilities
23 October 2023

USN-6441-2
Linux kernel (GCP) vulnerabilities
23 October 2023

USN-6444-2
Linux kernel (StarFive) vulnerabilities
24 October 2023

USN-6445-2
Linux kernel (Intel IoTG) vulnerabilities
24 October 2023

USN-6446-2
Linux kernel vulnerabilities
24 October 2023

USN-6440-3
Linux kernel (HWE) vulnerabilities
25 October 2023

USN-6446-3
Linux kernel (Oracle) vulnerabilities
26 October 2023

USN-6454-1
Linux kernel vulnerabilities
26 October 2023

USN-6441-3
Linux kernel vulnerabilities
30 October 2023

USN-6454-2
Linux kernel vulnerabilities
30 October 2023

USN-6466-1
Linux kernel (NVIDIA) vulnerabilities
31 October 2023

USN-6454-3
Linux kernel (ARM laptop) vulnerabilities
31 October 2023

USN-6454-4
Linux kernel (StarFive) vulnerabilities
1 November 2023

USN-6479-1
Linux kernel (OEM) vulnerabilities
14 November 2023

LSN-0099-1
Kernel Live Patch Security Notice
28 November 2023

Cvss 3 Severity Score