HIGH Public exploit Introduced in 5.9
netfilter ChainID UAF
CVE-2023-31248
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
02KernelScan AI Analysis
Risk summary
A local caller with network-administration rights in a network namespace can trigger a kernel use-after-free through a crafted nftables transaction; unprivileged user namespaces may make those rights available to an ordinary local user. Successful exploitation can crash the kernel or enable local privilege escalation to root.
Vulnerability analysis
When one nftables transaction deletes a chain and then adds a rule or jump referring to that chain by its numeric identifier, the original lookup could select the chain even though it had been marked for deletion because the lookup did not verify the transaction's active generation. The resulting rule could refer to a chain destroyed during commit, causing a use-after-free that may crash the kernel or permit kernel memory corruption and privilege escalation. The fix makes identifier-based lookups honor the transaction's active-generation state, causing the operation to fail rather than select a deleted chain. This is locally reachable through nftables and requires CAP_NET_ADMIN in the relevant network namespace; where unprivileged user namespaces are enabled, an unprivileged process can obtain that capability by creating user and network namespaces, without physical access or remote network input.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.9 | 5.10.188 | — |
| 5.15 | 5.9 | 5.15.121 | — |
| 6.1 | 5.9 | 6.1.39 | — |
| 6.4 | 5.9 | 6.4.4 | — |
| mainline | 5.9 | 6.5-rc2 | 515ad530795c |
| cip/5.10 | 5.9 | 5.10.191-cip38 | 4ae2e501331a |
| cip/5.10-rt | 5.9 | 5.10.194-cip39-rt16 | 4ae2e501331a |
| cip/6.1 | 5.9 | 6.1.42-cip2 | fc95c8b02c61 |
| cip/6.1-rt | 5.9 | 6.1.46-cip4-rt2 | fc95c8b02c61 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.1 | Fixed in 6.1.42-cip2 |
| cip/6.1-rt | Fixed in 6.1.46-cip4-rt2 |
| cip/5.10 | Fixed in 5.10.191-cip38 |
| cip/5.10-rt | Fixed in 5.10.194-cip39-rt16 |