HIGH Public exploit Introduced in 5.9
netfilter ChainBinding UAF
CVE-2023-3610
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.
02KernelScan AI Analysis
Risk summary
Hosts running the affected netfilter code are at risk from a local process with CAP_NET_ADMIN that submits a crafted nftables update. A failed rule construction can trigger a kernel use-after-free, and successful exploitation may escalate local privileges or compromise the confidentiality, integrity, or availability of the host.
Vulnerability analysis
When a new nftables rule targets a bound chain and a later expression fails, the original transaction did not retain the fact that binding had already happened. The rollback and rule-cleanup paths could therefore account for the same chain and its rules with unbalanced references, allowing the chain to be freed while a later cleanup step still accessed it and producing a use-after-free. The fix records that binding state, skips rollback work already handled by another transaction record, and balances references during preparation, commit, deletion, and rollback; it also rejects unsupported nested bindings. The trigger is a local control-plane operation: a process holding CAP_NET_ADMIN submits a crafted rule transaction through nftables, and it does not require an ordinary network packet or special hardware.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.9 | 5.10.188 | d53c295c1f43 |
| 5.15 | 5.9 | 5.15.119 | 314a8697d080 |
| 6.1 | 5.9 | 6.1.36 | 891cd2edddc7 |
| 6.6 | 5.9 | 6.6.11 | 9824064683a7 |
| mainline | 5.9 | 6.4 | 4bedf9eee016 |
| cip/5.10 | 5.9 | 5.10.191-cip38 | d53c295c1f43 |
| cip/5.10-rt | 5.9 | 5.10.194-cip39-rt16 | d53c295c1f43 |
| cip/6.1 | 5.9 | 6.1.38-cip1 | 891cd2edddc7 |
| cip/6.1-rt | 5.9 | 6.1.38-cip1-rt1 | 891cd2edddc7 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.1 | Fixed in 6.1.38-cip1 |
| cip/6.1-rt | Fixed in 6.1.38-cip1-rt1 |
| cip/5.10 | Fixed in 5.10.191-cip38 |
| cip/5.10-rt | Fixed in 5.10.194-cip39-rt16 |