Use After Free Affecting rtla package, versions <0:5.14.0-362.24.1.el9_3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE9-RTLA-6467512
- published 20 Mar 2024
- disclosed 6 Sep 2023
Introduced: 6 Sep 2023
CVE-2023-4244 Open this link in a new tabHow to fix?
Upgrade Oracle:9
rtla
to version 0:5.14.0-362.24.1.el9_3 or higher.
This issue was patched in ELSA-2024-1248
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream rtla
package and not the rtla
package as distributed by Oracle
.
See How to fix?
for Oracle:9
relevant fixed versions and status.
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.
We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.
References
- https://linux.oracle.com/cve/CVE-2023-4244.html
- https://linux.oracle.com/errata/ELSA-2023-13043.html
- https://linux.oracle.com/errata/ELSA-2024-12151.html
- https://linux.oracle.com/errata/ELSA-2024-12154.html
- https://linux.oracle.com/errata/ELSA-2024-1248.html
- https://linux.oracle.com/errata/ELSA-2024-3138.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e91b0ebd994635df2346353322ac51ce84ce6d8
- https://kernel.dance/3e91b0ebd994635df2346353322ac51ce84ce6d8
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html