In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: Avoid nfcthelper_hash uses after free
If nfconntrackinitstart() fails (for example due to a registernfconntrackbpf() failure), the nfconntrackhelperfini() clean-up path frees the nfcthelperhash map.
When built with NFCONNTRACK=y, further netfilter modules (e.g: netfilterconntrackftp) can still be loaded and call nfconntrackhelpersregister(), independently of whether nfconntrack initialized correctly. This accesses the nfcthelperhash dangling pointer and causes a uaf, possibly leading to random memory corruption.
This patch guards nfconntrackhelperregister() from accessing a freed or uninitialized nfcthelperhash pointer and fixes possible uses-after-free when loading a conntrack module.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53619.json"
}[
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f03ce2f1abcb9f9d0511e3659ca6eb60e39f566",
"id": "CVE-2023-53619-104ae2ce",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "337235556949886767625047972052704889387",
"length": 92.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f03ce2f1abcb9f9d0511e3659ca6eb60e39f566",
"id": "CVE-2023-53619-1174beb6",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "337235556949886767625047972052704889387",
"length": 92.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00716f25f9697d02a0d9bd622575c7c7321ba3d0",
"id": "CVE-2023-53619-19f7a870",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "31771543316045095505461229596094862062",
"length": 113.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ee69c91cb8f9ca144bc0861969e5a1a3c6152a7",
"id": "CVE-2023-53619-1e3ebe60",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"313629589755624594147282187301056040364",
"224647792119120230334452040666060547811"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f03ce2f1abcb9f9d0511e3659ca6eb60e39f566",
"id": "CVE-2023-53619-285702c7",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6eef7a2b933885a17679eb8ed0796ddf0ee5309b",
"id": "CVE-2023-53619-3082a326",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"22314719347961795006202609023060799013",
"144203735239068252997697220065618107352"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ee69c91cb8f9ca144bc0861969e5a1a3c6152a7",
"id": "CVE-2023-53619-311de7f2",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "63690878373813190323847625085258445407",
"length": 61.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fce5cc7cbd4b92f979bf02c9ec5fb69aaeba92d7",
"id": "CVE-2023-53619-5084d9d5",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "63690878373813190323847625085258445407",
"length": 61.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6eef7a2b933885a17679eb8ed0796ddf0ee5309b",
"id": "CVE-2023-53619-514507ef",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"126344848068540988965490260652967270983",
"159178370882290557100720500172625590359"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6eef7a2b933885a17679eb8ed0796ddf0ee5309b",
"id": "CVE-2023-53619-54224333",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8289d422f5e484efe4a565fe18e862ecd621c175",
"id": "CVE-2023-53619-6112c845",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "63690878373813190323847625085258445407",
"length": 61.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05561f822f27b9fa88fa5504ddec34bf38833034",
"id": "CVE-2023-53619-621cc583",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"313629589755624594147282187301056040364",
"224647792119120230334452040666060547811"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8289d422f5e484efe4a565fe18e862ecd621c175",
"id": "CVE-2023-53619-67e84f51",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"313629589755624594147282187301056040364",
"224647792119120230334452040666060547811"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61c7a5256543ae7d24cd9d21853d514c8632e1e9",
"id": "CVE-2023-53619-71e244a5",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "337235556949886767625047972052704889387",
"length": 92.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61c7a5256543ae7d24cd9d21853d514c8632e1e9",
"id": "CVE-2023-53619-7c4d1517",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61c7a5256543ae7d24cd9d21853d514c8632e1e9",
"id": "CVE-2023-53619-7e16e3a5",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "337235556949886767625047972052704889387",
"length": 92.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8289d422f5e484efe4a565fe18e862ecd621c175",
"id": "CVE-2023-53619-890fb34d",
"target": {
"function": "nf_conntrack_helper_fini",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"126344848068540988965490260652967270983",
"159178370882290557100720500172625590359"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05561f822f27b9fa88fa5504ddec34bf38833034",
"id": "CVE-2023-53619-a1482027",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05561f822f27b9fa88fa5504ddec34bf38833034",
"id": "CVE-2023-53619-a2c37594",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fce5cc7cbd4b92f979bf02c9ec5fb69aaeba92d7",
"id": "CVE-2023-53619-bca8579f",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"313629589755624594147282187301056040364",
"224647792119120230334452040666060547811"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00716f25f9697d02a0d9bd622575c7c7321ba3d0",
"id": "CVE-2023-53619-ccca0c9f",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ee69c91cb8f9ca144bc0861969e5a1a3c6152a7",
"id": "CVE-2023-53619-d8ac5cba",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"function_hash": "301188931455093466210090361933731891008",
"length": 1282.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00716f25f9697d02a0d9bd622575c7c7321ba3d0",
"id": "CVE-2023-53619-f6dd3391",
"target": {
"function": "nf_conntrack_helper_register",
"file": "net/netfilter/nf_conntrack_helper.c"
}
},
{
"digest": {
"line_hashes": [
"55667664912406992981469327093325026099",
"131503601604836374461341712508387144424",
"142254872541570174449771665350967787242",
"126344848068540988965490260652967270983",
"159178370882290557100720500172625590359"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fce5cc7cbd4b92f979bf02c9ec5fb69aaeba92d7",
"id": "CVE-2023-53619-fa5c32c0",
"target": {
"file": "net/netfilter/nf_conntrack_helper.c"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53619.json"