CVE-2023-1829

HighCVSS 7.8/10Last modified Jul 29, 2026

Description

A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.

We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ .

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Linux	Linux Kernel	>= 3.8.0, < 4.14.308; >= 4.15.0, < 4.19.276; >= 4.20.0, < 5.4.235; >= 5.5.0, < 5.10.173; >= 5.11.0, < 5.15.100; >= 5.16.0, < 6.1.18; >= 6.2.0, < 6.2.5

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8c710f75256bb3cf05ac7b1672c82b92c43f3d28Mailing List, Patch
https://kernel.dance/#8c710f75256bb3cf05ac7b1672c82b92c43f3d28Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230601-0001/Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8c710f75256bb3cf05ac7b1672c82b92c43f3d28Mailing List, Patch
https://kernel.dance/#8c710f75256bb3cf05ac7b1672c82b92c43f3d28Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230601-0001/Third Party Advisory

Timeline

Published: Apr 12, 2023
Last modified: Jul 29, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-18317.5Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the expe CVE-2023-18328.1An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result i CVE-2023-18339.8Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue CVE-2023-18349.1Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have CVE-2023-18356.1The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, CVE-2023-18365.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting fro CVE-2023-18378.8Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue aff CVE-2023-18387.1A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a CVE-2023-18394.8The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which co CVE-2023-18404.8The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to CVE-2023-18414.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web serve CVE-2023-18435.3The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing ca