CVE-2023-3609

Aliases:UBUNTU-CVE-2023-3609DEBIAN-CVE-2023-3609
Advisory lineage Upstream: 0 Downstream: 81
Analyzed
Published: 21 Jul 2023, 20:47
Last modified:30 Jul 2026, 16:34

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (cve.org)
EPSS Score
0.45% LOW
0% probability +0.44%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Jul 2023, 20:47
Published
Vulnerability first disclosed
30 Jul 2026, 16:34
Last Modified
Vulnerability information updated

Description

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.45%• Percentile: 39%

Techniques & Countermeasures

  • CWE-416•Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

  • debian•linux

    < 5.10.191-1 | < 6.1.37-1 | < 6.3.11-1 | < 6.3.11-1

  • ubuntu•linux

    < 5.4.0-159.176 | < 5.15.0-82.91

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    < 5.4.0-1108.116 | < 5.15.0-1043.48

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    < 5.15.0-1043.48~20.04.1

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    < 5.4.0-1108.116~18.04.1

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.2

    < 6.2.0-1010.10~22.04.1

  • ubuntu•linux-aws-fips

    < 5.4.0-1108.116+fips1 | all

  • ubuntu•linux-azure

    all | < 5.4.0-1114.120 | < 5.15.0-1045.52

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    < 5.15.0-1045.52~20.04.1

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    < 5.4.0-1115.122~18.04.1

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | < 5.15.0-1045.52.1

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fde-6.2

    all

  • ubuntu•linux-azure-fips

    < 5.4.0-1114.120+fips1 | all

  • ubuntu•linux-bluefield

    all | < 5.4.0-1070.76 | < 5.15.0-1022.24

  • ubuntu•linux-fips

    < 5.4.0-1083.92 | all

  • ubuntu•linux-gcp

    all | < 5.4.0-1111.120 | < 5.15.0-1040.48

  • ubuntu•linux-gcp-5.11

    all

  • ubuntu•linux-gcp-5.13

    all

  • ubuntu•linux-gcp-5.15

    < 5.15.0-1040.48~20.04.1

  • ubuntu•linux-gcp-5.19

    all

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.4

    < 5.4.0-1111.120~18.04.1

  • ubuntu•linux-gcp-5.8

    all

  • ubuntu•linux-gcp-6.2

    all

  • ubuntu•linux-gcp-fips

    < 5.4.0-1111.120+fips1 | all

  • ubuntu•linux-gke

    all | < 5.15.0-1040.45

  • ubuntu•linux-gke-4.15

    all

  • ubuntu•linux-gke-5.15

    all

  • ubuntu•linux-gke-5.4

    all

  • ubuntu•linux-gkeop

    < 5.4.0-1075.79 | < 5.15.0-1026.31

  • ubuntu•linux-gkeop-5.15

    < 5.15.0-1026.31~20.04.1

  • ubuntu•linux-gkeop-5.4

    all

  • ubuntu•linux-hwe

    all

  • ubuntu•linux-hwe-5.11

    all

  • ubuntu•linux-hwe-5.13

    all

Showing first 50 affected entries in server-rendered view.

References (29)