#VU103660 Memory leak in Linux kernel - CVE-2023-52924

Vulnerability identifier: #VU103660

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52924

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_rbtree_walk() function in net/netfilter/nft_set_rbtree.c, within the nft_rhash_walk() function in net/netfilter/nft_set_hash.c, within the nf_tables_dump_setelem() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/1da4874d05da1526b11b82fc7f3c7ac38749ddf8
https://git.kernel.org/stable/c/24138933b97b055d486e8064b4a1721702442a9b
https://git.kernel.org/stable/c/59dab3bf0b8fc08eb802721c0532f13dd89209b8
https://git.kernel.org/stable/c/7c7e658a36f8b1522bd3586d8137e5f93a25ddc5
https://git.kernel.org/stable/c/94313a196b44184b5b52c1876da6a537701b425a
https://git.kernel.org/stable/c/b15ea4017af82011dd55225ce77cce3d4dfc169c
https://git.kernel.org/stable/c/bd156ce9553dcaf2d6ee2c825d1a5a1718e86524

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.