CVE-2023-4206

What it actually does

Use-after-free in cls_route filter update path allows a local process to dereference freed memory in a bound tcf_result structure after tcf_unbind_filter decrements the class reference count, enabling arbitrary kernel memory manipulation and privilege escalation.

Why it matters to the business

A user with local shell access can obtain full root privileges on affected Linux systems, leading to complete host compromise, data theft, or persistence without requiring network access or elevated credentials.

How an attack unfolds

An attacker with a local account creates a route classifier bound to a traffic class, then repeatedly calls route4_change to replace the filter; the kernel copies the tcf_result but still unbinds the old instance, freeing the class while the filter still references it and allowing the attacker to reuse the dangling pointer for kernel code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 or later; rebuild and reboot with the patched kernel; if immediate patching is impossible, restrict untrusted local users and consider seccomp or LSM policies that limit netlink route operations.

How to confirm the fix worked

Verify the running kernel git commit or version string contains b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8; recompile a test module that exercises route4_change on a bound filter and confirm no crash or privilege gain occurs.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Load or exercise net/sched cls_route by creating a route filter attached to a class
3. Trigger repeated route4_change operations on the bound filter to induce the use-after-free
4. Spray or groom kernel heap to control the freed object
5. Achieve arbitrary read/write or ROP to escalate to root

How to detect it

Inspect kernel audit logs and netlink messages for repeated route filter creation and change operations from the same process; correlate with any subsequent unexpected privilege changes or crashes in cls_route; examine crash dumps for tcf_result or class reference count anomalies.

What your security team should do

• Patch all Linux hosts to a kernel containing the referenced commit within the next maintenance window
• Audit systems for local users who can load netlink route classifiers and apply least-privilege controls
• Monitor for future similar use-after-free reports in net/sched and schedule kernel updates accordingly