CVE-2023-3610

What it actually does

Use-after-free in nf_tables error handling path for bound chains during NFT_MSG_NEWRULE abort allows local memory corruption.

Why it matters to the business

Local attackers can gain full root privileges on affected Linux systems, enabling full host compromise and potential lateral movement within infrastructure.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates nftables rulesets containing bound chains that trigger an error condition; the resulting abort path frees an object that is later dereferenced, allowing construction of a kernel write primitive and escalation to root.

How to fix it

Upgrade the Linux kernel to a version containing commit 3602dbc57b556eff2456715301d35a1ef8964bba or later; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel commit or version string contains 3602dbc57b556eff2456715301d35a1ef8964bba; re-test nftables error paths with known trigger rulesets.

Typical attack path

1. Obtain CAP_NET_ADMIN capability on the target host
2. Load a malicious nftables ruleset that creates bound chains
3. Trigger an error in rule processing to invoke the abort path
4. Reuse the freed object to corrupt kernel memory structures
5. Execute privilege escalation payload to obtain root

How to detect it

Review kernel audit logs and nftables rule load events for unusual chain binding operations followed by process crashes or unexpected privilege changes; correlate with process execution of nft or related tools.

What your security team should do

• Apply the referenced kernel commit immediately on all production systems
• Audit which hosts grant CAP_NET_ADMIN to untrusted processes and reduce scope
• Monitor for new public exploits given the three-year disclosure window