In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: Avoid nfcthelper_hash uses after free
If nfconntrackinitstart() fails (for example due to a registernfconntrackbpf() failure), the nfconntrackhelperfini() clean-up path frees the nfcthelperhash map.
When built with NFCONNTRACK=y, further netfilter modules (e.g: netfilterconntrackftp) can still be loaded and call nfconntrackhelpersregister(), independently of whether nfconntrack initialized correctly. This accesses the nfcthelperhash dangling pointer and causes a uaf, possibly leading to random memory corruption.
This patch guards nfconntrackhelperregister() from accessing a freed or uninitialized nfcthelperhash pointer and fixes possible uses-after-free when loading a conntrack module.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53619.json",
"cna_assigner": "Linux"
}