Kernel: refcount leak in ctnetlink_create_conntrack()
Summary
| CVE | CVE-2023-7192 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-02 19:15:11 UTC |
| Updated | 2026-11-05 12:17:40 UTC |
| Description | A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow. |
Risk And Classification
Primary CVSS: v3.1 4.4 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-401 | CWE-401 Missing Release of Memory after Effective Lifetime
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 4.4 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 0:4.18.0-193.133.1.el8_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | unaffected 0:4.18.0-193.133.1.rt13.184.el8_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | unaffected 0:4.18.0-193.133.1.el8_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Update Services For SAP Solutions | unaffected 0:4.18.0-193.133.1.el8_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 0:4.18.0-305.125.1.el8_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | unaffected 0:4.18.0-305.125.1.rt7.201.el8_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | unaffected 0:4.18.0-305.125.1.el8_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Update Services For SAP Solutions | unaffected 0:4.18.0-305.125.1.el8_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | unaffected 0:4.18.0-372.95.1.el8_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | unaffected 0:4.18.0-477.51.1.el8_8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | unaffected 0:5.14.0-70.93.2.el9_0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | unaffected 0:5.14.0-70.93.1.rt21.165.el9_0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:5.14.0-284.52.1.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:5.14.0-284.52.1.rt14.337.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Virtualization 4 For Red Hat Enterprise Linux 8 | unaffected 0:4.18.0-372.95.1.el8_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2024:1404 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2008 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2006 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1250 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2023-7192 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2024:1188 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1306 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0723 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0725 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1367 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1382 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Mailing List, Patch |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-09-13T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2023-02-10T00:00:00.000Z | Made public. |
Workarounds
CNA: Triggering this issue requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Alternatively, skip loading the affected netfilter module (i.e., nf_conntrack_netlink) onto the system until we have a fix available. This can be done by a blacklist mechanism which will ensure the driver is not loaded at boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~
Legacy QID Mappings
- 161392 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2024-12193)
- 200126 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6646-1)
- 200127 Ubuntu Security Notification for Linux kernel Vulnerability (USN-6645-1)
- 200129 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6647-1)
- 200160 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-6647-2)
- 242887 Red Hat Update for kernel-rt (RHSA-2024:0725)
- 242908 Red Hat Update for kernel (RHSA-2024:0723)
- 243041 Red Hat Update for kernel security (RHSA-2024:1188)
- 243050 Red Hat Update for kernel (RHSA-2024:1250)
- 243062 Red Hat Update for kernel-rt (RHSA-2024:1306)
- 243076 Red Hat Update for kernel (RHSA-2024:1367)
- 243087 Red Hat Update for kernel (RHSA-2024:1404)
- 243096 Red Hat Update for kernel-rt (RHSA-2024:1382)
- 390295 Oracle VM Server for x86 Security Update for kernel (OVMSA-2024-0003)
- 673321 EulerOS Security Update for kernel (EulerOS-SA-2024-1337)
- 673547 EulerOS Security Update for kernel (EulerOS-SA-2024-1315)
- 673723 EulerOS Security Update for kernel (EulerOS-SA-2024-1237)
- 673992 EulerOS Security Update for kernel (EulerOS-SA-2024-1215)
- 674156 EulerOS Security Update for kernel (EulerOS-SA-2024-1509)
- 674158 EulerOS Security Update for kernel (EulerOS-SA-2024-1488)
- 907983 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (32316-1)