CVE-2023-4207

What it actually does

Use-after-free in cls_fw filter update path: fw_change copies tcf_result but tcf_unbind_filter on the old instance drops filter_cnt on a still-referenced class, allowing premature class deletion and subsequent access to freed memory.

Why it matters to the business

Local attackers can obtain root privileges on any affected Linux system, enabling full host compromise, data theft, persistence, or lateral movement from a single compromised user account.

How an attack unfolds

An attacker with local shell access creates a class-bound fw filter, then repeatedly calls fw_change to trigger the erroneous unbind path, freeing the class while references remain; the resulting dangling pointer is used to corrupt kernel structures and execute arbitrary code.

How to fix it

Upgrade the Linux kernel to a version containing commit 76e42ae831991c828cffa8c37736ebfb831ad5ec or later; apply the equivalent security update from the distribution vendor as soon as it is available.

How to confirm the fix worked

Confirm the running kernel contains commit 76e42ae831991c828cffa8c37736ebfb831ad5ec or the vendor backport; attempt to reproduce the filter update sequence under a restricted environment to verify the UAF is no longer reachable.

Typical attack path

1. Obtain a local shell as an unprivileged user
2. Use tc to install a class and bind an fw filter to it
3. Invoke fw_change on the filter to trigger the use-after-free
4. Spray kernel memory to control the freed object
5. Overwrite function pointers or credentials to gain root

How to detect it

Review audit logs for unusual sequences of tc filter add/change operations on the same class; monitor for unexpected kernel oops or warnings referencing cls_fw or tcf_unbind_filter; inspect process creation of tc or other traffic-control utilities from non-administrative users.

What your security team should do

• Prioritize kernel updates on all multi-user and internet-facing Linux systems
• Temporarily restrict untrusted local accounts where immediate patching is delayed
• Enable kernel hardening features such as lockdown and LSMs to reduce post-exploitation impact