CVE-2023-4623

    Dashboard / Vulnerabilities / CVE-2023-4623

    CVE-2023-4623

    Published: 6 Sept 2023Last Modified: 12 Aug 2026

    Summary: Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

    Details: A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

    References: http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html, https://git.kernel.org, https://kernel.dance/b3d26c5702c7d6c45456326e56d2ccf3f103e60f, https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html, https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4623.json, https://nvd.nist.gov/vuln/detail/CVE-2023-4623, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d26c5702c7d6c45456326e56d2ccf3f103e60f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9ee1c939d1cb936b1f98e8d81aeffab57bae46ab
    Fixed -ffc253263a1375a65fa6c9f62a893e9767fbebfa

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-4623 | CVE-DB