CVE-2023-39189

What it actually does

Unvalidated opt_num field in nfnl_osf_add_callback allows local privileged (CAP_NET_ADMIN) attacker to perform out-of-bounds read in the Netfilter subsystem, resulting in kernel crash or information disclosure.

Why it matters to the business

Linux systems may experience unexpected crashes or exposure of kernel memory contents to local administrators, impacting service availability and data confidentiality with no ransomware association or high exploitation likelihood observed.

How an attack unfolds

An attacker with CAP_NET_ADMIN privileges crafts a malicious nfnetlink message containing an out-of-range opt_num value and submits it to the nfnl_osf_add_callback function, triggering the out-of-bounds read.

How to fix it

Apply the kernel patch referenced by commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or upgrade to a fixed Linux kernel version containing this change.

How to confirm the fix worked

Verify the presence of the fix by inspecting the nfnl_osf_add_callback function implementation or confirming the kernel build includes commit ffc253263a1375a65fa6c9f62a893e9767fbebfa; test with crafted nfnetlink messages under controlled conditions.

Typical attack path

1. Obtain local access with CAP_NET_ADMIN capability
2. Construct nfnetlink OSF message with invalid opt_num field
3. Invoke nfnl_osf_add_callback via netfilter interface
4. Trigger out-of-bounds read causing crash or memory disclosure

How to detect it

Review kernel logs for netfilter-related crashes or warnings around nfnl_osf_add_callback; inspect audit logs for unusual nfnetlink activity by processes holding CAP_NET_ADMIN.

• nfnl_osf_add_callback
• opt_num field manipulation in nfnetlink OSF messages

What your security team should do

• Prioritize kernel upgrades to include commit ffc253263a1375a65fa6c9f62a893e9767fbebfa on all affected systems
• Restrict CAP_NET_ADMIN capability to only trusted processes
• Monitor for kernel oops or panics related to netfilter