CVE-2023-7192

MEDIUM

Linux Kernel < 6.3 - Memory Leak

Title source: rule

Description

A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

References (13)

[Third Party Advisory] https://access.redhat.com/security/cve/CVE-2023-7192

[Issue Tracking, Patch] https://bugzilla.redhat.com/show_bug.cgi?id=2256279

[Mailing List, Patch] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=ac4893980bbe79ce383daf9a0885666a30fe4c83

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0723

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0725

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1188

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1250

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1306

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1367

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1382

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:1404

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:2006

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:2008

Scores

CVSS v3 5.5

EPSS 0.0002

EPSS Percentile 5.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-401

Status published

Affected Products (3)

linux/linux_kernel < 6.3

redhat/enterprise_linux

redhat/enterprise_linux

Timeline

Published Jan 02, 2024

Tracked Since Feb 18, 2026