CVE-2023-3390

What it actually does

Mishandled error handling with NFT_MSG_NEWRULE in net/netfilter/nf_tables_api.c allows a dangling pointer to be used in the same transaction, resulting in a use-after-free condition that can be leveraged for privilege escalation.

Why it matters to the business

Local users can gain root-level control of affected systems, enabling full compromise; while exploitation maturity remains none and EPSS is stable at 0.0091, the 1206 days since publication means unpatched Debian systems running listed libvpx and chromium packages remain exposed.

How an attack unfolds

A local attacker with user privileges crafts a netfilter transaction containing NFT_MSG_NEWRULE that triggers an error path, leaving a dangling pointer; the same transaction then dereferences the pointer to corrupt kernel memory and escalate privileges.

How to fix it

Upgrade past Linux kernel commit 1240eb93f0616b21c675416516ff3d74798fdc97; for Debian packages apply the listed fixed versions including libvpx (Debian:11) 1.9.0-1+deb11u1, libvpx (Debian:12) 1.12.0-1+deb12u1, libvpx (Debian:13) 1.12.0-1.1, and chromium (Debian:11) 117.0.5938.132-1~deb11u1.

How to confirm the fix worked

Verify the running kernel contains commit 1240eb93f0616b21c675416516ff3d74798fdc97 or newer; confirm installed package versions match or exceed the supplied fixed versions for each Debian release.

Typical attack path

1. Obtain local user access on a vulnerable system
2. Load or interact with the netfilter subsystem
3. Submit a specially crafted NFT_MSG_NEWRULE message that induces an error
4. Reuse the resulting dangling pointer within the same transaction
5. Corrupt kernel structures to achieve privilege escalation

How to detect it

Review kernel logs for netfilter transaction errors or unusual NFT_MSG_NEWRULE activity; no public threat actor campaigns or ransomware usage are associated with this issue.

What your security team should do

• Prioritize kernel and package upgrades on all Debian systems matching the affected list
• Restrict untrusted local user access until patches are applied
• Monitor kernel logs for netfilter transaction errors as a temporary detection measure