{"api_version":"1","generated_at":"2026-04-22T23:53:39+00:00","cve":"CVE-2023-42756","urls":{"html":"https://cve.report/CVE-2023-42756","api":"https://cve.report/api/cve/CVE-2023-42756.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-42756","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-42756"},"summary":{"title":"CVE-2023-42756","description":"A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2023-09-28 14:15:00","updated_at":"2023-11-07 04:21:00"},"problem_types":["CWE-362"],"metrics":[],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","name":"https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","refsource":"MISC","tags":[],"title":"[SECURITY] [DLA 3623-1] linux-5.10 security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://seclists.org/oss-sec/2023/q3/242","name":"https://seclists.org/oss-sec/2023/q3/242","refsource":"MISC","tags":[],"title":"oss-sec: [CVE-2023-42756] Linux kernel race condition in netfilter","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/","refsource":"MISC","tags":[],"title":"[SECURITY] Fedora 38 Update: kernel-6.5.6-200.fc38 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/","refsource":"MISC","tags":[],"title":"[SECURITY] Fedora 37 Update: kernel-6.5.6-100.fc37 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/security/cve/CVE-2023-42756","name":"https://access.redhat.com/security/cve/CVE-2023-42756","refsource":"MISC","tags":[],"title":"cve-details","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/","refsource":"MISC","tags":[],"title":"[SECURITY] Fedora 39 Update: kernel-6.5.6-300.fc39 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239848","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2239848","refsource":"MISC","tags":[],"title":"2239848 – (CVE-2023-42756) CVE-2023-42756 kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42756","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42756","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"37","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"38","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"39","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.6","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.6","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"42756","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2023-42756","qid":"161237","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-13043)"},{"cve":"CVE-2023-42756","qid":"199841","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6444-1)"},{"cve":"CVE-2023-42756","qid":"199844","title":"Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-6445-1)"},{"cve":"CVE-2023-42756","qid":"199845","title":"Ubuntu Security Notification for Linux kernel (BlueField) Vulnerabilities (USN-6442-1)"},{"cve":"CVE-2023-42756","qid":"199846","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6441-1)"},{"cve":"CVE-2023-42756","qid":"199847","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6443-1)"},{"cve":"CVE-2023-42756","qid":"199848","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6446-1)"},{"cve":"CVE-2023-42756","qid":"199854","title":"Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-6441-2)"},{"cve":"CVE-2023-42756","qid":"199858","title":"Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-6445-2)"},{"cve":"CVE-2023-42756","qid":"199859","title":"Ubuntu Security Notification for Linux kernel (StarFive) Vulnerabilities (USN-6444-2)"},{"cve":"CVE-2023-42756","qid":"199861","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6446-2)"},{"cve":"CVE-2023-42756","qid":"199868","title":"Ubuntu Security Notification for Linux kernel (Oracle) Vulnerabilities (USN-6446-3)"},{"cve":"CVE-2023-42756","qid":"199872","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6441-3)"},{"cve":"CVE-2023-42756","qid":"199883","title":"Ubuntu Security Notification for Linux kernel (NVIDIA) Vulnerabilities (USN-6466-1)"},{"cve":"CVE-2023-42756","qid":"199893","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6479-1)"},{"cve":"CVE-2023-42756","qid":"199912","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6454-1)"},{"cve":"CVE-2023-42756","qid":"199913","title":"Ubuntu Security Notification for Linux kernel (StarFive) Vulnerabilities (USN-6454-4)"},{"cve":"CVE-2023-42756","qid":"199916","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6454-2)"},{"cve":"CVE-2023-42756","qid":"199918","title":"Ubuntu Security Notification for Linux kernel (ARM laptop) Vulnerabilities (USN-6454-3)"},{"cve":"CVE-2023-42756","qid":"284598","title":"Fedora Security Update for kernel (FEDORA-2023-50bd7c9c12)"},{"cve":"CVE-2023-42756","qid":"284599","title":"Fedora Security Update for kernel (FEDORA-2023-830d9ec624)"},{"cve":"CVE-2023-42756","qid":"285211","title":"Fedora Security Update for kernel (FEDORA-2023-c3bb819677)"},{"cve":"CVE-2023-42756","qid":"356530","title":"Amazon Linux Security Advisory for kernel : ALAS2023-2023-385"},{"cve":"CVE-2023-42756","qid":"356569","title":"Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2023-028"},{"cve":"CVE-2023-42756","qid":"6000265","title":"Debian Security Update for linux-5.10 (DLA 3623-1)"},{"cve":"CVE-2023-42756","qid":"6140204","title":"AWS Bottlerocket Security Update for kernel (GHSA-3gh7-4chv-fmw4)"},{"cve":"CVE-2023-42756","qid":"6140380","title":"AWS Bottlerocket Security Update for kernel (GHSA-j3v4-jxrr-6grv)"},{"cve":"CVE-2023-42756","qid":"673595","title":"EulerOS Security Update for kernel (EulerOS-SA-2023-3247)"},{"cve":"CVE-2023-42756","qid":"673692","title":"EulerOS Security Update for kernel (EulerOS-SA-2023-3275)"},{"cve":"CVE-2023-42756","qid":"907558","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (30055-1)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-42756","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","cweId":"CWE-362"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"kernel","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"versions":[{"version":"6.6-rc3","status":"unaffected"}]}}]}}]}},{"vendor_name":"Red Hat","product":{"product_data":[{"product_name":"Red Hat Enterprise Linux 6","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"unaffected"}}]}},{"product_name":"Red Hat Enterprise Linux 7","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"unaffected"}},{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"unaffected"}}]}},{"product_name":"Red Hat Enterprise Linux 8","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"unaffected"}},{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"unaffected"}}]}},{"product_name":"Red Hat Enterprise Linux 9","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"affected"}},{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"affected"}}]}}]}},{"vendor_name":"Fedora","product":{"product_data":[{"product_name":"Fedora","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"defaultStatus":"affected"}}]}}]}}]}},"references":{"reference_data":[{"url":"https://access.redhat.com/security/cve/CVE-2023-42756","refsource":"MISC","name":"https://access.redhat.com/security/cve/CVE-2023-42756"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239848","refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2239848"},{"url":"https://seclists.org/oss-sec/2023/q3/242","refsource":"MISC","name":"https://seclists.org/oss-sec/2023/q3/242"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/","refsource":"MISC","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/","refsource":"MISC","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/","refsource":"MISC","name":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/"},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","refsource":"MISC","name":"https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html"}]},"work_around":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}]}},"nvd":{"publishedDate":"2023-09-28 14:15:00","lastModifiedDate":"2023-11-07 04:21:00","problem_types":["CWE-362"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"},"exploitabilityScore":1,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}