CVE-2023-35001
Published on: Not Yet Published
Last Modified on: 09/11/2023 07:15:00 PM UTC
Certain versions of Debian Linux from Debian contain the following vulnerability:
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
- CVE-2023-35001 has been assigned by
secu[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: Linux - Linux Kernel version = v3.13-rc1
CVSS3 Score: 7.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| LOCAL | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| CVE-2023-35001 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security | security.netapp.com text/html |
MISC security.netapp.com/advisory/ntap-20230824-0007/ |
| oss-security - CVE-2023-35001 - Linux kernel nf_tables nft_byteorder_eval OOB read/write | www.openwall.com text/html |
MISC www.openwall.com/lists/oss-security/2023/07/05/3 |
| Kernel Live Patch Security Notice LSN-0097-1 ≈ Packet Storm | packetstormsecurity.com text/html |
MISC packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html |
| [SECURITY] Fedora 38 Update: kernel-headers-6.4.4-200.fc38 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
MISC lists.fedoraproject.org/archives/list/[email protected]/message/UPHI46ROSSLVAV4R5LJWJYU747JGOS6D/ |
| [PATCH] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval | lore.kernel.org text/html |
MISC lore.kernel.org/netfilter-devel/[email protected]/T/ |
| [SECURITY] Fedora 37 Update: kernel-tools-6.4.4-100.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
MISC lists.fedoraproject.org/archives/list/[email protected]/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E/ |
| oss-security - CVE-2023-35001 - Linux kernel nf_tables nft_byteorder_eval OOB read/write | www.openwall.com text/html |
MISC www.openwall.com/lists/oss-security/2023/07/05/3 |
| Kernel Live Patch Security Notice LSN-0096-1 ≈ Packet Storm | packetstormsecurity.com text/html |
MISC packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html |
| [SECURITY] [DLA 3512-1] linux-5.10 security update | lists.debian.org text/html |
MISC lists.debian.org/debian-lts-announce/2023/08/msg00001.html |
| Debian -- Security Information -- DSA-5453-1 linux | www.debian.org Depreciated Link text/html |
MISC www.debian.org/security/2023/dsa-5453 |
Related QID Numbers
- 199604 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6246-1)
- 199607 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6247-1)
- 199608 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6250-1)
- 199610 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6248-1)
- 199612 Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-6255-1)
- 199613 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6251-1)
- 199615 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6252-1)
- 199617 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6254-1)
- 199618 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6260-1)
- 199623 Ubuntu Security Notification for Linux kernel (IoT) Vulnerabilities (USN-6261-1)
- 199651 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6285-1)
- 284333 Fedora Security Update for kernel (FEDORA-2023-e4e985b5dd)
- 284334 Fedora Security Update for kernel (FEDORA-2023-3661f028b8)
- 355566 Amazon Linux Security Advisory for kernel : ALAS-2023-1783
- 355582 Amazon Linux Security Advisory for kernel : ALAS2-2023-2130
- 355591 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2023-024
- 355613 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2023-049
- 355616 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2023-037
- 355632 Amazon Linux Security Advisory for kernel : ALAS2023-2023-251
- 378701 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2023:0030)
- 378710 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0079)
- 754281 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3349-1)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
| Operating System | Fedoraproject | Fedora | 38 | All | All | All |
| Operating System | Linux | Linux Kernel | 3.13 | rc1 | All | All |
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*:
- cpe:2.3:o:linux:linux_kernel:3.13:rc1:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @oss_security |
CVE-2023-35001 - Linux kernel nf_tables nft_byteorder_eval OOB read/write: Posted by Thadeu Lima de Souza Cascardo… twitter.com/i/web/status/1… | 2023-07-05 17:47:35 |
| @CVEreport |
CVE-2023-35001 : #Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm reg… twitter.com/i/web/status/1… | 2023-07-05 19:07:31 |
| @cracbot |
CVE-2023-35001 (CVSS:7.8, HIGH) is Awaiting Analysis. Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability;… twitter.com/i/web/status/1… | 2023-07-06 06:00:14 |
| @TheZDIBugs |
[ZDI-23-900|CVE-2023-35001] (Pwn2Own) Linux Kernel nftables Incorrect Pointer Scaling Local Privilege Escalation Vu… twitter.com/i/web/status/1… | 2023-07-07 16:10:48 |
 /r/linkersec |
Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023 | 2023-09-06 00:22:13 |