| CVE ID | CVE-2023-31248 |
| CVSS SCORE | 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| AFFECTED VENDORS |
Linux |
| AFFECTED PRODUCTS |
Kernel |
| VULNERABILITY DETAILS |
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of nft_chains. The issue results from the lack of validating the status of a chain while processing lookup on the chain. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. |
| ADDITIONAL DETAILS |
Linux has issued an update to correct this vulnerability. More details can be found at:
https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/ |
| DISCLOSURE TIMELINE |
|
| CREDIT | Mingi Cho of Theori |
