Linux Netfilter nftables Use-After-Free Enables Local Privilege Escalation

A use-after-free flaw in the Linux kernel's Netfilter nftables nft_pipapo_walk function, tracked as CVE-2023-6817, can allow a local attacker with CAP_NET_ADMIN to crash a host, disclose information, or elevate privileges. The defect allowed inactive PIPAPO set elements to be processed and deactivated twice during a set walk, leading to a kernel crash; it carries a CVSS v3.1 score of 7.8.

Linux kernel commit 317eb9685095678f2c9f5a8189de698c5354316a fixes the issue by verifying that an element is active before invoking the iterator callback. Red Hat issued fixes for affected RHEL 8 kernel and kernel-rt packages; systems with unprivileged user namespaces enabled may let unprivileged users obtain the required capability. OpenShift Container Platform inherits the affected code through RHCOS, but Red Hat rates impact as Low because its namespace model prevents containers from acquiring the capabilities needed to exploit the flaw.