CVE-2023-35001

What it actually does

The vulnerability permits an out-of-bounds read/write in the Linux kernel nftables subsystem because nft_byteorder mishandles virtual machine register contents when CAP_NET_ADMIN is held in any user or network namespace.

Why it matters to the business

Local attackers can corrupt kernel memory to escalate privileges, potentially compromising system integrity, confidentiality, and availability across Linux environments; the large number of dependent systems increases operational exposure even though current exploitation metrics remain low.

How an attack unfolds

An attacker with local access obtains CAP_NET_ADMIN in a user or network namespace, then submits crafted nftables byteorder expressions that trigger improper register handling and cause memory corruption usable for further exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit 887433e4bc9394676d22c038dba33a27405f94e8; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 887433e4bc9394676d22c038dba33a27405f94e8, then exercise nftables byteorder operations inside user and network namespaces to verify absence of crashes or memory errors.

Typical attack path

1. Obtain local interactive access to a Linux host
2. Acquire CAP_NET_ADMIN in a user or network namespace
3. Load malicious nftables rules via the nft utility that target byteorder handling
4. Trigger the out-of-bounds condition to corrupt kernel memory
5. Leverage corruption for privilege escalation or arbitrary code execution

How to detect it

Search kernel logs and audit trails for nftables errors or unexpected byteorder operations; inspect process execution history for nft invocations inside non-root namespaces around suspected compromise times.

What your security team should do

• Apply the referenced kernel commit to all production systems without delay
• Limit CAP_NET_ADMIN grants to the minimum required namespaces and users
• Review nftables rule sets for unexpected or complex byteorder expressions
• Include kernel version checks in regular vulnerability scanning