CVE-2023-31248

What it actually does

Use-after-free in nft_chain_lookup_byid allows local users with CAP_NET_ADMIN in any namespace to corrupt kernel memory and escalate privileges.

Why it matters to the business

Local attackers can gain root on Linux hosts and containers, enabling full system takeover; the issue has remained exploitable for over three years with low but steady probability.

How an attack unfolds

An attacker with local access obtains CAP_NET_ADMIN, crafts nftables rules that bypass the inactive-chain check in nft_chain_lookup_byid, triggers the use-after-free, and leverages memory corruption to run arbitrary code as root; similar techniques appear in VMSCAPE and container-focused privilege-escalation campaigns.

How to fix it

Upgrade the Linux kernel to commit 3602dbc57b556eff2456715301d35a1ef8964bba or later; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 3602dbc57b556eff2456715301d35a1ef8964bba, then exercise nftables chain creation and deletion under CAP_NET_ADMIN to ensure no crashes or privilege escalation occur.

Typical attack path

1. Gain local shell access
2. Obtain CAP_NET_ADMIN capability
3. Load and manipulate nftables chains to hit the flawed lookup path
4. Trigger use-after-free for kernel memory corruption
5. Escalate to root and execute payload

How to detect it

Review kernel logs for nft_chain_lookup_byid references or oops messages, auditd records of CAP_NET_ADMIN usage followed by nft commands, and any post-nftables process executions that indicate privilege changes.

• nft_chain_lookup_byid
• nftables.*chain.*lookup
• kernel:.*use-after-free.*nft

What your security team should do

• Apply the kernel fix immediately on all nftables-using systems
• Limit CAP_NET_ADMIN grants to the minimum necessary users and namespaces
• Harden container runtimes to reduce namespace privilege exposure
• Audit local capability usage and nftables configuration changes