CVE-2023-42753

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2023
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-427545.5A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device CVE-2023-427555.5A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear CVE-2023-427564.7A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a ker CVE-2023-427574.2Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executa CVE-2023-42768.8The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to CVE-2023-427655.4An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the CVE-2023-427667.8Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of CVE-2023-427687.2When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to CVE-2023-427699.8The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid s CVE-2023-42776.5The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing CVE-2023-427709.8Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication chall CVE-2023-427718.8Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a net