CVE-2023-4387

What it actually does

A use-after-free vulnerability in vmxnet3_rq_alloc_rx_buf allows a local attacker to trigger a double-free during vmxnet3_rq_cleanup_all, resulting in kernel crash or information leak.

Why it matters to the business

Local attackers can crash affected Linux systems or leak kernel memory, leading to denial of service and potential exposure of sensitive data on systems using the vmxnet3 driver.

How an attack unfolds

A local attacker interacts with the vmxnet3 ethernet driver to allocate RX buffers and then forces a cleanup path that reuses freed memory, causing a double-free that crashes the kernel or discloses memory contents. No known widespread campaigns or ransomware use.

How to fix it

Update the Linux kernel to include commit 04b092e4a01a3488e762897e2d29f85eda2c6a60 or later. If the driver is unnecessary, disable vmxnet3 support at compile time or via module blacklisting.

How to confirm the fix worked

Confirm the presence of the fixing commit in the kernel source tree and perform functional testing of network operations under the vmxnet3 driver to ensure no crashes occur during buffer management.

Typical attack path

1. Gain local access on a target Linux system
2. Load or interact with the vmxnet3 network driver
3. Trigger repeated RX buffer allocation and cleanup operations
4. Exploit the use-after-free to induce crash or read kernel memory

How to detect it

Review kernel logs for oops, panic, or warnings referencing vmxnet3 buffer allocation and cleanup functions; inspect for repeated driver interactions preceding crashes.

• vmxnet3_rq_alloc_rx_buf
• vmxnet3_rq_cleanup_all
• double-free in vmxnet3

What your security team should do

• Apply the kernel update containing the referenced commit to all systems using vmxnet3
• Audit kernel configurations to remove unused network drivers
• Monitor kernel logs for oops or panic events tied to vmxnet3