CVE-2023-3609

What it actually does

Use-after-free in Linux kernel net/sched cls_u32 when tcf_change_indev() fails after reference counter manipulation in tcf_bind_filter() via u32_set_parms(), allowing attacker-controlled free of object still in use.

Why it matters to the business

Local attackers can escalate to root privileges on affected Linux systems, risking full host compromise; low urgency given absence from KEV, low EPSS, and no ransomware or APT associations despite 1183 days since publication.

How an attack unfolds

Local user triggers failure path in tcf_change_indev() to increment/decrement reference counter, sets it to zero causing premature free, then reuses the dangling pointer to execute arbitrary code for privilege escalation.

How to fix it

Upgrade Linux kernel past commit 04c55383fa5689357bcdd2c8036725a55ed632bc; for squid-cache/squid update to commit b70f864940225dfe69f9f653f948e787f99c3810.

How to confirm the fix worked

Verify kernel version or squid commit is newer than the listed fixes; test that cls_u32 filter operations no longer allow reference counter underflow leading to free.

Typical attack path

1. Obtain local non-root shell access
2. Craft input to cls_u32 filter that forces tcf_change_indev() failure
3. Manipulate reference counter in tcf_bind_filter() to zero
4. Trigger use-after-free dereference
5. Gain kernel code execution and root privileges

How to detect it

Review kernel logs for cls_u32 related oops or use-after-free warnings; audit system calls involving tcf_bind_filter and net/sched filters for anomalous reference counter behavior; check for unexpected root processes after local user activity.

What your security team should do

• Apply kernel or squid patch immediately on all affected hosts
• Monitor for local privilege escalation attempts via audit logs
• Restrict local user access where possible until patched
• Scan for any post-exploitation artifacts if systems were exposed