Loading vulnerability…
CVE-2023-3390 is a use-after-free vulnerability in the Linux kernel's Netfilter nftables subsystem. Mishandled error handling for NFT_MSG_NEWRULE leaves a dangling pointer accessible within the same transaction. The vulnerability involves processing named and anonymous sets in batch requests, with subsequent access through nft_set_lookup_global. A local attacker with the required network-administration capability can exploit the flaw to perform arbitrary kernel-memory reads and writes, crash the system, or potentially escalate privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (PoC) exploit for CVE-2023-3390, a vulnerability in the Linux kernel's nftables subsystem. The repository consists of two files: a README.md briefly describing the PoC, and poc.c, which contains the exploit code. The C code sets up new user, network, and mount namespaces, then interacts with the kernel's nftables subsystem via netlink sockets. It creates nftables tables, chains, and sets, and injects a specially crafted rule designed to trigger the vulnerability. The exploit is local and requires the ability to create namespaces and interact with nftables. No remote endpoints or network services are targeted; the exploit communicates directly with the kernel via NETLINK_NETFILTER. The code is a PoC and does not include a weaponized payload, but demonstrates the ability to trigger the bug, which could potentially be leveraged for privilege escalation or kernel compromise on vulnerable systems.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An older Linux kernel Netfilter integer-overflow vulnerability that could permit kernel-memory writes and privilege escalation to root. It appears only as a background example and is explicitly excluded from the current advisory.
A use-after-free vulnerability in the Linux kernel nftables subsystem.
Linux kernel nftables use-after-free involving nft_set_lookup_global and named and anonymous sets in batch requests.
Linux kernel nftables use-after-free triggered through nft_set_lookup_global after processing named and anonymous sets in batch requests.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.