Bug 6281 - 【4.19】Bugfix for CVE-2023-3117
Summary: 【4.19】Bugfix for CVE-2023-3117
Status: RESOLVED FIXED
Alias: None
Product: ANCK 4.19 Dev
Classification: ANCK
Component: net (show other bugs) net
Version: unspecified
Hardware: All Linux
: P3-Medium S3-normal
Target Milestone: ---
Assignee: XuanZhuo
QA Contact: shuming
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-30 09:45 UTC by tangbinzy
Modified: 2023-08-31 10:30 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description tangbinzy cmss_group 2023-08-30 09:45:27 UTC 
一、漏洞信息
漏洞编号：CVE-2023-3117
漏洞归属组件：kernel
漏洞归属的版本：4.19、5.10
CVSS V3.0分值：
BaseScore：7.8 High
Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.
漏洞公开时间：2023-07-01 06:15:00
漏洞创建时间：2023-06-30 06:39:34
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-3117
Comment 1 小龙 admin 2023-08-30 13:41:47 UTC 
The PR Link: https://gitee.com/anolis/cloud-kernel/pulls/2106
Comment 2 小龙 admin 2023-08-31 10:30:56 UTC 
PR: 
https://gitee.com/anolis/cloud-kernel/pulls/2106