TI-2023-05562 Aliases CVE-2023-6040 GHSA-cw47-8xqr-cfh2

Out-of-bounds read in linux

LOW 34CWE-125Published 2024-01-12 · Updated 2025-06-17

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 11 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00309 23rd percentileScored 2026-11-07

Fix Partial linux (The Linux Kernel Organization): 5.18-rc1Red Hat: 3 advisoriesRed Hat: 11 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	linux	before 5.18-rc1	5.18-rc1	Patch available	CNA

linux VendorLinux Affected before 5.18-rc1 Fixed in 5.18-rc1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	4.16 to before 4.19.305; 4.20 to before 5.4.267; 5.5 to before 5.10.208; 5.11 to before 5.15.147; 5.16 to before 5.18	Vulnerable	Linux
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.16 to before 4.19.305; 4.20 to before 5.4.267; 5.5 to before 5.10.208; 5.11 to before 5.15.147; 5.16 to before 5.18 Vulnerable ·Linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA linux (The Linux Kernel Organization) Fixed in 5.18-rc1

Red Hat 3 advisories

RHSA-2024:7000 Released 2024-09-24 · Red Hat rating Important
kernel security update
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.22.1.el8_10, kernel-4.18.0-553.22.1.el8_10, kernel-abi-stablelists-4.18.0-553.22.1.el8_10 +19
- Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.22.1.el8_10
RHSA-2024:7001 Released 2024-09-24 · Red Hat rating Important
kernel-rt security update
- Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.22.1.rt7.363.el8_10, kernel-rt-core-4.18.0-553.22.1.rt7.363.el8_10, kernel-rt-debug-4.18.0-553.22.1.rt7.363.el8_10 +9
- Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.22.1.rt7.363.el8_10, kernel-rt-core-4.18.0-553.22.1.rt7.363.el8_10, kernel-rt-debug-4.18.0-553.22.1.rt7.363.el8_10 +7
RHSA-2024:2394 Released 2024-04-30 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.13.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.13.1.el9_4, kernel-64k-devel-5.14.0-427.13.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.13.1.el9_4, kernel-5.14.0-427.13.1.el9_4, kernel-64k-5.14.0-427.13.1.el9_4 +29
- Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.13.1.el9_4, libperf-5.14.0-427.13.1.el9_4
- Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +11
- Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 9	Affected	No fix yet
RHOAI-2.13-RHEL-8	Fixed	—
RHOAI-2.14-RHEL-8	Fixed	—
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2024:7000
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux CRB (v. 8)	Fixed	RHSA-2024:7000
Red Hat Enterprise Linux CRB (v. 9)	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux NFV (v. 8)	Fixed	RHSA-2024:7001
Red Hat Enterprise Linux NFV (v. 9)	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux RT (v. 8)	Fixed	RHSA-2024:7001
Red Hat Enterprise Linux RT (v. 9)	Fixed	RHSA-2024:2394

Timeline

2026-10-02 Threatist record created from CVE-2023-6040
2026-10-03 Alias added: GHSA-cw47-8xqr-cfh2
2026-10-30 Fix available: RHOAI-2.13-RHEL-8, RHOAI-2.14-RHEL-8 · Red Hat

References

Patch 1

http://www.openwall.com/lists/oss-security/2024/01/12/1

Advisory 5

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3

See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences