CVE-2023-3773

What it actually does

The flaw permits a process holding CAP_NET_ADMIN to supply a crafted XFRMA_MTIMER_THRESH netlink attribute that triggers a 4-byte out-of-bounds read inside the XFRM packet transformation subsystem, exposing adjacent kernel heap contents to userspace.

Why it matters to the business

Local privileged users may obtain fragments of kernel heap memory that could contain sensitive data such as keys or credentials, raising the risk of further privilege escalation or information disclosure on affected Linux systems.

How an attack unfolds

An attacker first obtains CAP_NET_ADMIN, crafts a netlink message containing an out-of-bounds XFRMA_MTIMER_THRESH attribute, sends it through the XFRM netlink interface, and reads the leaked heap bytes returned to userspace.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix for the XFRM netlink attribute parsing logic; apply the corresponding security update from the distribution vendor for Red Hat Enterprise Linux, Fedora, or Debian.

How to confirm the fix worked

Verify the running kernel version against the fixed release listed in the vendor advisory, review the XFRM netlink parsing code for the corrected attribute length check, and confirm that CAP_NET_ADMIN users can no longer trigger the out-of-bounds read in testing.

Typical attack path

1. Acquire CAP_NET_ADMIN capability on the target host
2. Open an AF_NETLINK socket and bind to the XFRM netlink group
3. Construct a malicious nlattr structure with XFRMA_MTIMER_THRESH set to trigger the off-by-four read
4. Transmit the netlink message to the kernel
5. Receive and parse the leaked heap data returned in the response

How to detect it

Review kernel audit logs and netlink socket activity for unusual XFRM attribute handling; examine any process that successfully uses CAP_NET_ADMIN and inspects returned netlink payloads for unexpected data lengths.

What your security team should do

• Apply the kernel security update as soon as it is available from the distribution
• Restrict use of CAP_NET_ADMIN to the minimum set of trusted processes
• Monitor netlink XFRM traffic for anomalous attribute lengths if feasible