high 7.8

CVE-2023-3777 json

Use-after-free in Linux kernel's netfilter: nf_tables component

published 2023-09-06 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-44410

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

Patch / fix

fixed in 2 distros 4 links 2

Linux Kernel 6.5
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1

debian ubuntu red hat suse

linux Debian 12 6.1.52-1
linux Debian 14, Debian 13 6.4.11-1

debian advisories DEBIAN-CVE-2023-3777

linux Ubuntu 22.04 LTS 5.15.0-82.91
linux-aws Ubuntu 22.04 LTS 5.15.0-1043.48
linux-gcp Ubuntu 22.04 LTS 5.15.0-1040.48
linux-gke Ubuntu 22.04 LTS 5.15.0-1040.45
linux-ibm Ubuntu 22.04 LTS 5.15.0-1036.39
linux-kvm Ubuntu 22.04 LTS 5.15.0-1040.45
linux-azure Ubuntu 22.04 LTS 5.15.0-1045.52
linux-gkeop Ubuntu 22.04 LTS 5.15.0-1026.31

ubuntu advisories UBUNTU-CVE-2023-3777

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-362.18.1.el9_3
rv RHEL 9 5.14.0-362.18.1.el9_3
perf RHEL 9 5.14.0-362.18.1.el9_3
rtla RHEL 9 5.14.0-362.18.1.el9_3
bpftool RHEL 9 7.2.0-362.18.1.el9_3
libperf RHEL 9 5.14.0-362.18.1.el9_3
kernel-rt RHEL 9 5.14.0-362.18.1.el9_3
kernel-64k RHEL 9 5.14.0-362.18.1.el9_3

red hat advisories RHSA-2024:0461 RHSA-2024:0439 RHSA-2024:0431 RHSA-2024:0432 RHSA-2024:0448

kernel-rt SLE Micro 5.5, Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.27.2
kernel-syms-rt Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.27.1
kernel-rt_debug Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.27.2
kernel-source-rt Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.27.2
kernel-azure SLE Module for Public Cloud 15 SP5, openSUSE Leap 15.5 5.14.21-150500.33.23.1
kernel-syms-azure SLE Module for Public Cloud 15 SP5, openSUSE Leap 15.5 5.14.21-150500.33.23.1
kernel-source-azure SLE Module for Public Cloud 15 SP5, openSUSE Leap 15.5 5.14.21-150500.33.23.1
dtb-aarch64 openSUSE Leap 15.4 5.14.21-150400.24.97.1

suse advisories SUSE-SU-2023:4872-1 SUSE-SU-2023:4871-1 SUSE-SU-2023:4867-1 SUSE-SU-2023:4863-1 SUSE-SU-2023:4862-1 SUSE-SU-2023:4848-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3777 updated 2026-11-07 cvss 7.8

kernel: use-after-free in netfilter: nf_tables

Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
affected: workaround, no fix available
Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-362.18.1.el9_3, kernel-debuginfo-common-s390x 5.14.0-362.18.1.el9_3, kernel-debuginfo-common-x86_64 5.14.0-362.18.1.el9_3, kernel-debuginfo-common-aarch64 5.14.0-362.18.1.el9_3, kernel-debuginfo-common-ppc64le 5.14.0-362.18.1.el9_3
fixed: vendor fix RHSA-2024:0461
Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-debuginfo-common-s390x 5.14.0-70.85.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.85.1.el9_0, kernel-debuginfo-common-aarch64 5.14.0-70.85.1.el9_0, kernel-debuginfo-common-ppc64le 5.14.0-70.85.1.el9_0
fixed: vendor fix RHSA-2024:0432
Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-debuginfo-common-s390x 5.14.0-284.48.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.48.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.48.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.48.1.el9_2
fixed: vendor fix RHSA-2024:0448
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-362.18.1.el9_3, perf 5.14.0-362.18.1.el9_3, rtla 5.14.0-362.18.1.el9_3, kernel-devel-matched 5.14.0-362.18.1.el9_3, kernel-64k-devel-matched 5.14.0-362.18.1.el9_3, kernel-debug-devel-matched 5.14.0-362.18.1.el9_3, +6 more
fixed: vendor fix RHSA-2024:0461
Red Hat Enterprise Linux AppStream EUS (v.9.0) perf 5.14.0-70.85.1.el9_0, kernel-devel-matched 5.14.0-70.85.1.el9_0, kernel-debug-devel-matched 5.14.0-70.85.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.85.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.85.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.85.1.el9_0, +2 more
fixed: vendor fix RHSA-2024:0432
Red Hat Enterprise Linux AppStream EUS (v.9.2) perf 5.14.0-284.48.1.el9_2, rtla 5.14.0-284.48.1.el9_2, kernel-devel-matched 5.14.0-284.48.1.el9_2, kernel-64k-devel-matched 5.14.0-284.48.1.el9_2, kernel-debug-devel-matched 5.14.0-284.48.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.48.1.el9_2, +5 more
fixed: vendor fix RHSA-2024:0448
Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.2.0-362.18.1.el9_3, kernel 5.14.0-362.18.1.el9_3, kernel-64k 5.14.0-362.18.1.el9_3, kernel-core 5.14.0-362.18.1.el9_3, kernel-tools 5.14.0-362.18.1.el9_3, python3-perf 5.14.0-362.18.1.el9_3, +28 more
fixed: vendor fix RHSA-2024:0461

show 9 more

Red Hat Enterprise Linux BaseOS EUS (v.9.0) kernel 5.14.0-70.85.1.el9_0, bpftool 5.14.0-70.85.1.el9_0, kernel-core 5.14.0-70.85.1.el9_0, kernel-tools 5.14.0-70.85.1.el9_0, python3-perf 5.14.0-70.85.1.el9_0, kernel-modules 5.14.0-70.85.1.el9_0, +14 more
fixed: vendor fix RHSA-2024:0432
Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool 7.0.0-284.48.1.el9_2, kernel 5.14.0-284.48.1.el9_2, kernel-64k 5.14.0-284.48.1.el9_2, kernel-core 5.14.0-284.48.1.el9_2, kernel-tools 5.14.0-284.48.1.el9_2, python3-perf 5.14.0-284.48.1.el9_2, +28 more
fixed: vendor fix RHSA-2024:0448
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-362.18.1.el9_3, kernel-rt-core 5.14.0-362.18.1.el9_3, kernel-rt-modules 5.14.0-362.18.1.el9_3, kernel-rt-debug-core 5.14.0-362.18.1.el9_3, kernel-rt-modules-core 5.14.0-362.18.1.el9_3, kernel-rt-debug-modules 5.14.0-362.18.1.el9_3, +4 more
fixed: vendor fix RHSA-2024:0461
Red Hat Enterprise Linux Real Time EUS (v.9.0) kernel-rt 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-core 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-modules 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-debug-core 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-debug-modules 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-modules-extra 5.14.0-70.85.1.rt21.156.el9_0, +2 more
fixed: vendor fix RHSA-2024:0431
Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-core 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-modules 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-debug-core 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-modules-core 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-debug-modules 5.14.0-284.48.1.rt14.333.el9_2, +4 more
fixed: vendor fix RHSA-2024:0439
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-362.18.1.el9_3, kernel-rt-kvm 5.14.0-362.18.1.el9_3, kernel-rt-core 5.14.0-362.18.1.el9_3, kernel-rt-modules 5.14.0-362.18.1.el9_3, kernel-rt-debug-kvm 5.14.0-362.18.1.el9_3, kernel-rt-debug-core 5.14.0-362.18.1.el9_3, +6 more
fixed: vendor fix RHSA-2024:0461
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) kernel-rt 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-kvm 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-core 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-modules 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-debug-kvm 5.14.0-70.85.1.rt21.156.el9_0, kernel-rt-debug-core 5.14.0-70.85.1.rt21.156.el9_0, +4 more
fixed: vendor fix RHSA-2024:0431
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-kvm 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-core 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-modules 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-debug-kvm 5.14.0-284.48.1.rt14.333.el9_2, kernel-rt-debug-core 5.14.0-284.48.1.rt14.333.el9_2, +6 more
fixed: vendor fix RHSA-2024:0439
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-doc 5.14.0-284.48.1.el9_2
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-166-11 updated 2024-04-09 cvss 7.8

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem <V1.1
affected: fixed in V1.1, workaround support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness

CWE-416 Use After Free

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
patch, issue-tracking, mailing-list, vendor-advisory
kernel.dance /6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
patch, vendor-advisory
debian.org /security/2023/dsa-5492
third-party-advisory
packetstormsecurity.com /files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
third-party-advisory, vdb-entry
packetstormsecurity.com /files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
third-party-advisory, vdb-entry
cert-portal.siemens.com /productcert/html/ssa-794697.html

Sources

CVE List CVE-2023-3777
NVD CVE-2023-3777

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary