CVE-2023-3106

What it actually does

NULL pointer dereference in netlink_dump triggered by XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY messages with the DUMP flag set, resulting in a kernel crash or denial of service; privilege escalation cannot be fully excluded though considered unlikely.

Why it matters to the business

Linux systems handling IPsec or network policy queries can experience sudden crashes or service interruptions, reducing availability and requiring manual recovery or reboots; the age of the issue and lack of widespread exploitation lower immediate risk but still warrant patching in affected environments.

How an attack unfolds

A local attacker with low privileges crafts and sends a netlink message of type XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY with the DUMP flag via sendmsg, causing the kernel to dereference a null pointer during dump processing and trigger a crash or limited further impact.

How to fix it

Apply the kernel patch referenced by commit 34a0362f84457031a9252c7ffc30263c9cc00bf9 or upgrade to a fixed Linux kernel version containing this change; disable unnecessary XFRM netlink interfaces where feasible as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel contains commit 34a0362f84457031a9252c7ffc30263c9cc00bf9 via git log or version string; attempt to reproduce the message sequence in a test environment and confirm no crash occurs.

Typical attack path

1. Obtain local user access on a Linux system
2. Construct a malicious netlink socket message targeting XFRM_GETSA or XFRM_GETPOLICY with DUMP flag
3. Invoke sendmsg on the socket to trigger netlink_dump
4. Observe kernel NULL dereference leading to crash or denial of service

How to detect it

Inspect kernel logs and dmesg output for NULL pointer dereference panics or oops messages involving netlink_dump or XFRM message handling; correlate with processes sending XFRM netlink requests.

What your security team should do

• Prioritize kernel upgrades to the fixed commit in all production Linux distributions handling XFRM
• Monitor for related kernel oops reports in system logs
• Restrict untrusted local access and netlink capabilities until patched
• Review downstream package updates for the fixed version in distributions