CVE-2023-3772

What it actually does

NULL pointer dereference in xfrm_update_ae_params() within the Linux kernel XFRM subsystem when handling AE parameter updates without proper validation, resulting in kernel panic.

Why it matters to the business

Denial of service on Linux hosts that disrupts network traffic processing, containers, or entire systems, increasing operational downtime risk in environments with broad administrative privileges.

How an attack unfolds

An attacker obtains CAP_NET_ADMIN and sends crafted netlink messages to update XFRM AE parameters, hitting the unchecked NULL dereference in xfrm_update_ae_params and triggering an immediate kernel crash.

How to fix it

Apply the latest available Linux kernel patches from distribution vendors that add the missing NULL check in xfrm_update_ae_params; rebuild and reboot into fixed kernels where provided by Red Hat, Debian, or Fedora.

How to confirm the fix worked

Verify kernel source contains a NULL guard before dereferencing fields in xfrm_update_ae_params; test with reproducer netlink sequences and confirm absence of panic; compare running kernel version against vendor advisories.

Typical attack path

1. Gain CAP_NET_ADMIN capability on a Linux host
2. Craft malicious XFRM AE update via netlink or iproute2
3. Invoke xfrm_update_ae_params with invalid parameters
4. Trigger NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for oops or panic entries referencing xfrm_update_ae_params or the XFRM subsystem; correlate with netlink activity from processes holding CAP_NET_ADMIN.

• xfrm_update_ae_params
• NULL dereference in XFRM
• kernel: unable to handle kernel NULL pointer
• netlink XFRM AE update

What your security team should do

• Limit CAP_NET_ADMIN to minimal trusted processes and containers
• Monitor kernel logs for XFRM-related oops and panics
• Prioritize kernel upgrades on internet-facing and multi-tenant systems
• Harden netlink access controls where feasible