CVE-2023-4004

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

HIGH

7.8

CVSS Score

Published: July 31, 2023 at 04:22 PM UTC

Updated: October 14, 2026 at 10:17 PM UTC

8 products affected across 5 vendorsLinux KernelDebian LinuxFedora

Using Red Hat Enterprise Linux 8 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 8 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.9%

Description

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

10.0 11.0 12.0

Fedora · Fedora Projectrpm

95%

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1235.16 ≤ v < 6.1.425.6 ≤ v < 5.10.1886.2 ≤ v < 6.4.7

Affected range stops below 5.10.188, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.15.123, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.42, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.4.7, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

95%

8.0 9.0

Vendor states this is fixed in 0:4.18.0-193.119.1.el8_2 (unaffected)

Vendor states this is fixed in 0:4.18.0-193.119.1.rt13.170.el8_2 (unaffected)

Vendor states this is fixed in 0:4.18.0-305.103.1.el8_4 (unaffected)

Vendor states this is fixed in 0:4.18.0-305.103.1.rt7.178.el8_4 (unaffected)

Vendor states this is fixed in 0:4.18.0-372.75.1.el8_6 (unaffected)

Vendor states this is fixed in 0:4.18.0-477.27.1.el8_8 (unaffected)

Vendor states this is fixed in 0:4.18.0-477.27.1.rt7.290.el8_8 (unaffected)

Vendor states this is fixed in 0:5.14.0-284.30.1.el9_2 (unaffected)

Vendor states this is fixed in 0:5.14.0-284.30.1.rt14.315.el9_2 (unaffected)

Vendor states this is fixed in 0:5.14.0-70.80.1.el9_0 (unaffected)

Vendor states this is fixed in 0:5.14.0-70.80.1.rt21.151.el9_0 (unaffected)

Vendor states this is fixed in 6 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Vendor states this is fixed in 8 (unaffected)

H300S · NetAppdevice

95%

All versions

H410S · NetAppdevice

95%

All versions

H500S · NetAppdevice

95%

All versions

H700S · NetAppdevice

95%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references