CVE-2023-32233

Published May 8, 2023

Last updated 7 days ago

CVSS high 7.8

Overview

Description
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
Source
cve@mitre.org
NVD status
Modified
Products
linux_kernel, enterprise_linux, hci_baseboard_management_controller

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

nvd@nist.gov
CWE-416
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-416

Social media

Hype score
Not currently trending

  1. CRITICAL: Linux kernel vuln CVE-2023-32233 (nftables UAF) lets attackers root Ubuntu 18.04+/cloud systems. šŸšØ Patch cmd: sudo apt install --only-upgrade linux-image-$(uname -r) Read more: šŸ‘‰ https://t.co/XSfttYh4k8 #CVE #InfoSec https://t.co/ifUXJSdY6A

    @Cezar_H_Linux

    30 Jul 2025

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 1. Linux Kernel Vulnerabilities CVE-2023-32233: A use-after-free vulnerability in the Linux kernel's networking subsystem could lead to privilege escalation or system crashes. While this primarily affects networking, kernel-level exploits could destabilize input device drivers.ā€¦

    @ghidraDragon

    5 Feb 2025

    35 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Configurations

Related CVEs

  1. A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.ā€¢CVE-2026-104046
  2. A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.ā€¢CVE-2026-104045
  3. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.ā€¢CVE-2026-104048
  4. A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.ā€¢CVE-2026-104047
  5. A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.ā€¢CVE-2026-88252

References

Sources include official advisories and independent security research.