Executive brief
The Linux kernel's netfilter ebtables module improperly manages firewall rule table memory during updates, causing freed memory to be accessed later. An attacker with access to modify firewall rules could trigger a crash or potentially execute code when the system performs network namespace cleanup.
Technical details
A use-after-free vulnerability exists in the netfilter ebtables implementation (net/bridge/netfilter/ebtables.c) in the do_replace_finish() function. The vulnerability occurs when find_table_lock() returns a valid table pointer but with a non-zero return code; the function proceeds to update table->private with a new rule blob, then frees that blob in the caller due to the error return, leading to freed memory access. The bug is triggered during netfilter table replacement operations and manifests as vmalloc-out-of-bounds reads during network namespace cleanup. The vulnerability requires local access to modify firewall rules (via netlink socket). A patch fixes this by ensuring successful completion returns 0 rather than propagating error codes from find_table_lock().
Affected products
- Linux Linux kernel 5.15 and others; fixed in commit e58a171d35e32e6e8c37cfe0e8a94406732a331f
Timeline
- 2023-02-17: disclosed
- 2023-03-11: patched: Fix included in stable kernel trees
- 2025-12-30: other: CVE-2023-54243 published