CVE-2023-42753: Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-25 · updated 2026-10-15
Weakness: CWE-787

Description

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

Affected products

Debian Linux: 10.0
Linux kernel: from 4.4.165 before 4.5; from 4.9.141 before 4.10; from 4.14.84 before 4.15; from 4.19.5 before 4.19.295; from 4.20 before 5.4.257; from 5.5 before 5.10.195 — fixed in 4.10, 4.15, 4.19.295, 4.5, 5.10.195, 5.15.132
Red Hat Enterprise Linux: 7.0, 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 4.15, 4.19.295, 4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-42753 or the next vulnerability affects your stack