Loading vulnerability…
CVE-2023-3390 is a use-after-free in the Linux kernel Netfilter nftables implementation, in nf_tables transaction handling. A set can be processed as both named and anonymous during a batch transaction. When a rule referencing that set is destroyed, nftables may free the set because it is marked anonymous while a transaction-list reference remains usable due to its named-set state. A subsequent rule lookup can dereference the freed set, including through nft_set_lookup_global. The resulting dangling-pointer access can enable kernel-memory reads and writes.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (PoC) exploit for CVE-2023-3390, a vulnerability in the Linux kernel's nftables subsystem. The repository consists of two files: a README.md briefly describing the PoC, and poc.c, which contains the exploit code. The C code sets up new user, network, and mount namespaces, then interacts with the kernel's nftables subsystem via netlink sockets. It creates nftables tables, chains, and sets, and injects a specially crafted rule designed to trigger the vulnerability. The exploit is local and requires the ability to create namespaces and interact with nftables. No remote endpoints or network services are targeted; the exploit communicates directly with the kernel via NETLINK_NETFILTER. The code is a PoC and does not include a weaponized payload, but demonstrates the ability to trigger the bug, which could potentially be leveraged for privilege escalation or kernel compromise on vulnerable systems.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in the Linux kernel nftables subsystem.
Linux kernel nftables use-after-free involving nft_set_lookup_global and named and anonymous sets in batch requests.
Linux kernel nftables use-after-free triggered through nft_set_lookup_global after processing named and anonymous sets in batch requests.
Linux kernel nftables use-after-free vulnerability involving global set lookup during batch handling of named and anonymous sets.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.