CVE-2023-3812

What it actually does

Out-of-bounds memory access in the Linux kernel TUN/TAP driver when processing oversized packets with napi frags enabled, enabling local denial of service or privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can crash hosts or obtain elevated privileges, risking full system compromise; low urgency due to stable low EPSS and no known exploitation but kernel updates remain necessary for systems using TUN/TAP.

How an attack unfolds

A local attacker crafts a malicious oversized networking packet targeting the TUN/TAP device driver with napi frags enabled, triggering the out-of-bounds access to crash the system or achieve code execution for privilege escalation.

How to fix it

Update the Linux kernel to a version containing commit 363a5328f4b0 or later; rebuild and deploy updated kernel packages across affected systems.

How to confirm the fix worked

Verify kernel version includes commit 363a5328f4b0, confirm TUN/TAP functionality remains operational, and test with known packet generation tools to ensure the flaw is absent.

Typical attack path

1. Obtain local user access on target Linux system
2. Ensure napi frags is enabled on the TUN/TAP interface
3. Generate and send oversized malicious packet
4. Trigger out-of-bounds memory access in driver
5. Crash system or escalate privileges

How to detect it

Inspect kernel logs for TUN/TAP related oops or out-of-bounds errors, audit logs for unexpected privilege changes, and review network packet traces involving TAP interfaces.

What your security team should do

• Prioritize kernel updates to include commit 363a5328f4b0 on all systems using TUN/TAP
• Review and restrict unnecessary local user access where feasible
• Monitor kernel logs for related oops or crashes during rollout