{"id":"CVE-2023-4147","state":"PUBLISHED","title":"Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free","description":"A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.","publishedAt":"2023-08-07T13:19:43.593Z","updatedAt":"2026-02-25T17:20:10.372Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.rt14.315.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/a:redhat:enterprise_linux:9::nfv"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kpatch-patch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-70.80.1.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.0::baseos","cpe:/a:redhat:rhel_eus:9.0::appstream","cpe:/a:redhat:rhel_eus:9.0::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:5.14.0-70.80.1.rt21.151.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::nfv","cpe:/a:redhat:rhel_eus:9.0::realtime"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kpatch-patch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.0::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":["https://access.redhat.com/errata/RHSA-2023:5069","https://access.redhat.com/errata/RHSA-2023:5091","https://access.redhat.com/errata/RHSA-2023:5093","https://access.redhat.com/errata/RHSA-2023:7382","https://access.redhat.com/errata/RHSA-2023:7389","https://access.redhat.com/errata/RHSA-2023:7411","https://access.redhat.com/security/cve/CVE-2023-4147","https://bugzilla.redhat.com/show_bug.cgi?id=2225239","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211","https://www.spinics.net/lists/stable/msg671573.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","https://security.netapp.com/advisory/ntap-20231020-0006/","https://www.debian.org/security/2023/dsa-5480","https://www.debian.org/security/2023/dsa-5492"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4147.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-4147","state":"PUBLISHED","datePublished":"2023-08-07T13:19:43.593Z","dateUpdated":"2026-02-25T17:20:10.372Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-08-03T20:23:06.353Z"},"containers":{"cna":{"title":"Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free","descriptions":[{"lang":"en","value":"A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.rt14.315.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/a:redhat:enterprise_linux:9::nfv"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-284.30.1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kpatch-patch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-70.80.1.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.0::baseos","cpe:/a:redhat:rhel_eus:9.0::appstream","cpe:/a:redhat:rhel_eus:9.0::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:5.14.0-70.80.1.rt21.151.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::nfv","cpe:/a:redhat:rhel_eus:9.0::realtime"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"kpatch-patch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.0::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5069","name":"RHSA-2023:5069","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5091","name":"RHSA-2023:5091","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5093","name":"RHSA-2023:5093","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7382","name":"RHSA-2023:7382","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7389","name":"RHSA-2023:7389","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7411","name":"RHSA-2023:7411","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4147","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225239","name":"RHBZ#2225239","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211"},{"url":"https://www.spinics.net/lists/stable/msg671573.html"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-20T07:12:49.304Z"},"datePublic":"2023-07-23T10:30:00.000Z","x_redhatCweChain":"CWE-416: Use After Free","timeline":[{"lang":"en","time":"2023-07-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-07-23T10:30:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5069","name":"RHSA-2023:5069","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5091","name":"RHSA-2023:5091","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5093","name":"RHSA-2023:5093","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7382","name":"RHSA-2023:7382","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7389","name":"RHSA-2023:7389","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7411","name":"RHSA-2023:7411","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4147","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225239","name":"RHBZ#2225239","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231020-0006/","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5480","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5492","tags":["x_transferred"]},{"url":"https://www.spinics.net/lists/stable/msg671573.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:17:12.131Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-4147","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-01-09T15:55:27.469292Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-25T17:20:10.372Z"}}]}}}