Loading vulnerability…
Linux Kernel nftables nft_chain_lookup_byid Use-After-Free Privilege Escalation
CVE-2023-31248 is a use-after-free vulnerability in the Linux kernel Netfilter nftables subsystem, in nf_tables function nft_chain_lookup_byid(). The function did not validate that a chain identified by ID was active for the applicable generation mask. Consequently, an nftables batch transaction could delete a chain and subsequently create a rule that references the now-inactive chain by its ID. The stale reference can survive transaction processing and, through a race between rule deletion/transaction abort handling and asynchronous transaction-destruction work, can reference chain memory after it has been freed. Upstream remediation adds generation-mask validation to chain-by-ID lookup and updates relevant callers so inactive chains cannot be returned or referenced.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local attacker with CAP_NET_ADMIN in a user namespace or network namespace can exploit the use-after-free to escalate privileges to kernel-level execution and obtain root privileges. The memory-corruption condition may also cause kernel instability or denial of service.
If you can’t patch tonight, do this now.
Until patched, restrict local access by untrusted users and containers, and avoid delegating CAP_NET_ADMIN. Disable or tightly constrain unprivileged user-namespace creation where operationally feasible, and limit access to network namespaces and nftables configuration interfaces. These measures reduce exploitability but do not replace applying a fixed kernel.
Patch, then assume compromise.
Install the vendor-supported Linux kernel update containing the fix for CVE-2023-31248, then reboot into the updated kernel unless the vendor supplies and documents an applicable live patch. For Red Hat Enterprise Linux 9, apply the relevant kernel, kernel-rt, or kpatch-patch security update. For SUSE products, install the applicable kernel security or live-patch update for the deployed product and kernel stream. Ubuntu systems should update to a kernel version containing the fix; the referenced vulnerable Ubuntu generic kernels precede 6.2.0-26-generic.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.