{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54200", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.499Z", "datePublished": "2025-12-30T12:09:05.538Z", "dateUpdated": "2026-08-05T09:17:58.739Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:58.739Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always release netdev hooks from notifier\n\nThis reverts \"netfilter: nf_tables: skip netdev events generated on netns removal\".\n\nThe problem is that when a veth device is released, the veth release\ncallback will also queue the peer netns device for removal.\n\nIts possible that the peer netns is also slated for removal. In this\ncase, the device memory is already released before the pre_exit hook of\nthe peer netns runs:\n\nBUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0\nRead of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45\nWorkqueue: netns cleanup_net\nCall Trace:\n nf_hook_entry_head+0x1b8/0x1d0\n __nf_unregister_net_hook+0x76/0x510\n nft_netdev_unregister_hooks+0xa0/0x220\n __nft_release_hook+0x184/0x490\n nf_tables_pre_exit_net+0x12f/0x1b0\n ..\n\nOrder is:\n1. First netns is released, veth_dellink() queues peer netns device\n for removal\n2. peer netns is queued for removal\n3. peer netns device is released, unreg event is triggered\n4. unreg event is ignored because netns is going down\n5. pre_exit hook calls nft_netdev_unregister_hooks but device memory\n might be free'd already." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through nfnetlink (nf_tables) configuration plus netns/veth lifecycle operations, all of which require local access via syscalls (netlink, unshare, rtnetlink). No remote packet processing is involved in triggering the UAF.\nAC:L - The attacker fully controls both namespaces, the veth pair, the nft basechain, and the timing of both netns exits, and can retry the create/destroy loop indefinitely at no cost until the two namespaces land in separate cleanup_net batches.\nPR:L - nf_tables netdev basechain creation only needs CAP_NET_ADMIN in the netns' owning user namespace (netlink_net_capable), which any unprivileged user obtains with `unshare -Urn`; veth pairs and netns teardown are likewise available inside that userns.\nUI:N - The entire sequence is driven by the attacker's own processes; the UAF fires in the kernel's cleanup_net workqueue with no action from any other user.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no hypervisor, IOMMU, or other cross-authority boundary crossed.\nC:H - This is a use-after-free: nf_hook_entry_head() reads dev_net(dev) and *pp out of the freed net_device, and the resulting attacker-influenceable pointer is dereferenced, enabling disclosure of kernel memory contents after heap spraying.\nI:H - __nf_unregister_net_hook() writes into the freed object (rcu_assign_pointer(*pp, new)) and nf_remove_net_hook() performs WRITE_ONCE through a pointer loaded from freed memory, giving a heap-spray-controllable write primitive suitable for control-flow hijacking.\nA:H - KASAN confirms a slab-use-after-free in the cleanup_net kworker; the corruption reliably produces an oops/panic, and a fault in cleanup_net additionally wedges all subsequent network-namespace teardown." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_chain_filter.c" ], "versions": [ { "version": "68a3765c659f809dcaac20030853a054646eb739", "lessThan": "8d56f00c61f67b450fbbdcb874855e60ad92c560", "status": "affected", "versionType": "git" }, { "version": "68a3765c659f809dcaac20030853a054646eb739", "lessThan": "30e4b13b1bfbdf3bf3b27036d8209ea1b9f0d880", "status": "affected", "versionType": "git" }, { "version": "68a3765c659f809dcaac20030853a054646eb739", "lessThan": "94032527efbac13be702c76afb9d872c0cca7a43", "status": "affected", "versionType": "git" }, { "version": "68a3765c659f809dcaac20030853a054646eb739", "lessThan": "dc1c9fd4a8bbe1e06add9053010b652449bfe411", "status": "affected", "versionType": "git" }, { "version": "90c7c58aa2bd02c65a4c63b7dfe0b16eab12cf9f", "status": "affected", "versionType": "git" }, { "version": "5.14.15", "lessThan": "5.15", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_chain_filter.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.113", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8d56f00c61f67b450fbbdcb874855e60ad92c560" }, { "url": "https://git.kernel.org/stable/c/30e4b13b1bfbdf3bf3b27036d8209ea1b9f0d880" }, { "url": "https://git.kernel.org/stable/c/94032527efbac13be702c76afb9d872c0cca7a43" }, { "url": "https://git.kernel.org/stable/c/dc1c9fd4a8bbe1e06add9053010b652449bfe411" } ], "title": "netfilter: nf_tables: always release netdev hooks from notifier", "x_generator": { "engine": "bippy-1.2.0" } } } }