CVE-2023-39193

What it actually does

Missing validation of flag_count in sctp_mt_check allows out-of-bounds read in the Netfilter SCTP match extension, resulting in kernel crash or disclosure of adjacent kernel memory to a local CAP_NET_ADMIN process.

Why it matters to the business

Linux systems may experience unexpected kernel panics or leakage of sensitive kernel data when a privileged local user interacts with netfilter SCTP rules; impact is limited to hosts where untrusted local users hold network administration capabilities.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates a netfilter table and chain containing an SCTP match rule with an oversized or negative flag_count value, causing the kernel to read past the intended structure bounds during rule evaluation and either crash the system or return memory contents to user space.

How to fix it

Upgrade the Linux kernel to a version containing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; rebuild and reboot with the patched kernel. Where live patching is available, apply the vendor's live patch for this commit.

How to confirm the fix worked

Verify the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa via /proc/version_signature or kernel build logs; attempt to add an SCTP match rule with invalid flag_count and confirm the operation now fails safely without oops or leak.

Typical attack path

1. Obtain local shell with CAP_NET_ADMIN capability
2. Load or reference the nf_tables and nf_conntrack modules
3. Invoke nft to add a table, chain, and rule using the sctp match with crafted flag_count
4. Trigger rule evaluation via packet processing or rule dump
5. Observe kernel oops/panic or harvest leaked memory from the operation result

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or BUG messages referencing sctp_mt_check or net/netfilter/nf_tables_api.c near SCTP match evaluation; inspect audit logs for nft commands adding sctp matches with anomalous parameters.

• sctp_mt_check
• flag_count
• nf_tables_api.c
• out-of-bounds read
• CAP_NET_ADMIN

What your security team should do

• Prioritize patching of internet-facing or multi-tenant Linux hosts that expose netfilter to untrusted local users
• Audit systems for CAP_NET_ADMIN grants and reduce where possible
• Monitor kernel logs for sctp_mt_check related oops or warnings
• Apply the fixed commit or equivalent distribution update within standard change windows given low EPSS and absence from KEV