CVE-2023-4147

What it actually does

Use-after-free in Linux kernel Netfilter nf_tables when adding a rule with NFTA_RULE_CHAIN_ID, enabling local memory corruption that can result in kernel panic or arbitrary code execution for privilege escalation.

Why it matters to the business

Unpatched Linux systems face risk of local crashes or full system compromise by any logged-in user, potentially disrupting services or allowing data access; the issue is over three years old with stable low exploit likelihood.

How an attack unfolds

A local attacker interacts with the nftables interface to submit a specially crafted rule referencing a chain ID via NFTA_RULE_CHAIN_ID, triggering the use-after-free to corrupt kernel memory structures and either crash the system or redirect execution for root access.

How to fix it

Upgrade the Linux kernel to include commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 or apply the equivalent fix from stable kernel releases.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or a later backport; inspect nf_tables.c for the corrected handling of NFTA_RULE_CHAIN_ID and test rule addition under load.

Typical attack path

1. Gain local shell access as a non-privileged user
2. Invoke nft or netlink APIs to add a rule containing NFTA_RULE_CHAIN_ID
3. Trigger the use-after-free condition during rule processing
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and audit trails for nf_tables errors, use-after-free oops messages, or unexpected crashes during nft rule operations; correlate with nft command invocations from non-root users.

What your security team should do

• Apply the kernel fix containing commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 immediately on all affected systems
• Limit untrusted local accounts and use mandatory access controls
• Enable kernel hardening features such as KASAN or lockdown mode where feasible