CVE-2023-4459

What it actually does

A NULL pointer dereference in vmxnet3_rq_cleanup due to a missing sanity check during cleanup of the vmxnet3 network driver.

Why it matters to the business

Local users can crash affected Linux systems, causing denial of service and interrupting workloads until reboot.

How an attack unfolds

A local attacker with normal privileges triggers vmxnet3 interface cleanup paths that lack proper validation, dereferencing a NULL pointer and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f or later.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source tree or verify the driver no longer crashes under the previously triggering cleanup conditions.

Typical attack path

1. Gain local shell access as a normal user
2. Trigger vmxnet3_rq_cleanup through interface teardown or error paths
3. Trigger NULL dereference resulting in kernel panic

How to detect it

Inspect kernel panic and dmesg logs for NULL pointer dereference messages originating from vmxnet3_rq_cleanup or vmxnet3_drv.c.

What your security team should do

• Apply the referenced kernel commit or a distribution update containing the fix
• Limit untrusted local accounts on systems using vmxnet3
• Review kernel crash logs for vmxnet3-related panics