CVE-2023-1076

What it actually does

Tun/tap sockets have UID hardcoded to 0 due to type confusion in initialization, causing incorrect ownership treatment in network filtering and routing decisions that may bypass filters even when CAP_NET_ADMIN is held by non-root users.

Why it matters to the business

Network security controls relying on socket ownership for filtering or routing can be bypassed on systems using tun/tap devices, increasing exposure to unauthorized traffic flows without requiring full root privileges.

How an attack unfolds

An attacker with CAP_NET_ADMIN but without root UID creates a tun/tap device, triggering the type confusion that forces socket UID to 0; subsequent filtering or routing decisions then treat the socket as root-owned and permit actions that would otherwise be denied.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the type confusion in tun/tap socket initialization; rebuild and reboot affected systems with the corrected kernel.

How to confirm the fix worked

Confirm the running kernel version includes the ownership fix; create tun/tap sockets as a non-root CAP_NET_ADMIN user and verify that socket UID is no longer forced to 0 and that filter behavior matches expectations.

Typical attack path

1. Obtain CAP_NET_ADMIN capability on a Linux system
2. Create or open a tun/tap device to trigger the flawed initialization path
3. Observe or force network filter/routing decisions that incorrectly grant elevated treatment
4. Bypass intended network controls to send or receive traffic

How to detect it

Inspect kernel logs and audit records for tun/tap device creation by non-root users; examine socket ownership via ss or netstat output and compare against expected UID values; review network filter logs for unexpected bypass events tied to tun/tap interfaces.

What your security team should do

• Prioritize kernel updates on all systems that expose tun/tap interfaces
• Review network filter rules that depend on socket ownership for correctness after patching
• Monitor upstream kernel changelogs for the specific tun/tap ownership correction commit