CVE-2023-39194

What it actually does

Out-of-bounds read during XFRM state filter processing in the Linux kernel allows a local privileged user to read past an allocated buffer boundary, resulting in disclosure of kernel memory contents.

Why it matters to the business

A local administrator on affected Linux systems could obtain sensitive kernel data, increasing risk of further attacks on high-value hosts; the issue affects a widely used kernel subsystem but carries low exploitation likelihood given its age, low EPSS score, and absence from known exploited lists.

How an attack unfolds

An attacker with CAP_NET_ADMIN capabilities crafts malicious XFRM state filters that trigger the flawed processing path, causing an out-of-bounds read that returns kernel memory to user space without requiring additional privileges or network access.

How to fix it

Update the Linux kernel to a version containing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or later; apply vendor-supplied patches for the affected distribution and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or a backported equivalent; inspect /proc/config.gz or kernel build logs for the fix and test XFRM filter handling with boundary-case inputs.

Typical attack path

1. Obtain local access and CAP_NET_ADMIN capability on a vulnerable Linux system
2. Prepare and submit crafted XFRM netlink messages containing malformed state filters
3. Trigger the kernel's filter processing routine to perform the out-of-bounds read
4. Receive leaked kernel memory contents in the response for further analysis or credential extraction

How to detect it

Review kernel audit logs and netlink message traces for unusual XFRM state filter submissions from non-standard processes; correlate with any unexpected information disclosure events or subsequent privilege-escalation attempts.

What your security team should do

• Prioritize kernel updates on systems where CAP_NET_ADMIN is granted to non-root users or containers
• Audit usage of XFRM/IPsec configuration interfaces and restrict CAP_NET_ADMIN where feasible
• Monitor EPSS trend and any future KEV inclusion given the 1103-day publication age
• Include the fixed commit hash in patch management and vulnerability scanning policies