Loading vulnerability…
Local privilege escalation in Linux kernel Netfilter nf_tables
CVE-2023-32233 is a use-after-free vulnerability in the Linux kernel Netfilter nf_tables subsystem through version 6.3.1. Improper handling of anonymous sets during batch requests to update nf_tables configuration can cause access to freed memory. A local attacker with the required network-administration capability can exploit the flaw to perform arbitrary kernel-memory reads and writes, potentially obtaining root privileges or crashing the system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise system confidentiality and integrity through arbitrary kernel-memory reads and writes and local privilege escalation to root. Exploitation can also crash the kernel, causing system-wide denial of service.
If you can’t patch tonight, do this now.
Prevent the affected nf_tables module from loading where it is not required, ensuring it is not already active. On non-containerized RHEL deployments where nf_tables cannot be disabled, disable user namespaces by setting user.max_user_namespaces=0 to block unprivileged users from obtaining the required capability through that mechanism. This does not prevent exploitation by users already holding CAP_NET_ADMIN. Do not disable user namespaces on containerized deployments such as OpenShift that require them; blocking nf_tables remains an option only where Netfilter is not used.
Patch, then assume compromise.
Install the distribution-specific kernel update addressing CVE-2023-32233 and reboot into the updated kernel. Fixed builds include RHEL 8 kernel 4.18.0-477.13.1.el8_8 under RHSA-2023:3349 and RHEL 9.0 EUS kernel 5.14.0-70.58.1.el9_0 under RHSA-2023:3465; other release streams require their corresponding updates. Real-time kernel users must install the applicable kernel-rt update. Where supported, install the vendor-provided kpatch live patch for the exact running kernel and verify that it is loaded.
3 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.