CVE-2023-3609

HighCVSS 7.8/10Last modified Oct 14, 2026

Description

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxKernel>= 4.14.0, < 4.14.322; >= 4.15.0, < 4.19.291; >= 4.20.0, < 5.4.248; >= 5.5.0, < 5.10.185; >= 5.11.0, < 5.15.118; >= 5.16.0, < 6.1.35; >= 6.2.0, < 6.3.9
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
Jul 21, 2023
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-360909.8Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This CVE-2023-360919.8Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_CVE-2023-360929.8Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTCVE-2023-360935.4There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend managementCVE-2023-360959.8An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affecCVE-2023-360979.8funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.CVE-2023-36107.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. CVE-2023-361009.8An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameterCVE-2023-361039.8Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands CVE-2023-361067.5An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the inteCVE-2023-361099.8Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raCVE-2023-36117.8An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalati
CVE-2023-3609: High severity, CVSS 7.8 | Vulnix