CVE-2023-3863

What it actually does

Use-after-free in nfc_llcp_find_local allows a privileged local user to read kernel memory contents via the NFC LLCP subsystem.

Why it matters to the business

Privileged local attackers on affected Linux systems can leak kernel data that may assist further attacks, though exploitation requires high privileges and no ransomware use or broad campaigns have been observed.

How an attack unfolds

An attacker with root-level access on a vulnerable system triggers NFC LLCP operations that free an object still referenced by nfc_llcp_find_local, then reads the dangling pointer to extract kernel memory.

How to fix it

Update the Linux kernel to the fixed commit 6709d4b7bc2e079241fdef15d1160581c5261c10 or any later version that resolves the flaw in net/nfc/llcp_core.c.

How to confirm the fix worked

Confirm the running kernel contains commit 6709d4b7bc2e079241fdef15d1160581c5261c10, or verify that nfc_llcp_find_local no longer exhibits the use-after-free pattern through source inspection or targeted testing.

Typical attack path

1. Gain local root or equivalent privileges
2. Invoke or manipulate NFC LLCP socket operations to reach nfc_llcp_find_local
3. Trigger use-after-free and read leaked kernel memory

How to detect it

Examine kernel logs and audit records for unusual NFC LLCP activity or repeated calls to nfc_llcp_find_local; no public exploit artifacts are known.

What your security team should do

• Apply the referenced kernel commit or distribution backport as soon as feasible
• Disable NFC support via kernel configuration if the feature is unused
• Review systems for unnecessary high-privilege local accounts