CVE-2023-4569

What it actually does

Memory leak in nft_set_catchall_flush caused by double-deactivation of catchall elements in the netfilter nf_tables subsystem.

Why it matters to the business

Local users on affected Linux systems can trigger gradual memory exhaustion leading to performance degradation or denial of service; low exploitation likelihood reduces urgency but kernel updates remain necessary for long-term stability.

How an attack unfolds

A local attacker with the ability to manage nftables sets crafts a configuration that invokes nft_set_catchall_flush repeatedly, forcing double-deactivation of catchall elements and leaking kernel memory on each iteration.

How to fix it

Upgrade the Linux kernel to a version containing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or later; apply the fix via distribution package updates once available.

How to confirm the fix worked

Verify the running kernel contains commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or a later equivalent; test nftables catchall flush operations under load to confirm absence of repeated memory growth.

Typical attack path

1. Obtain local user access on a Linux system
2. Load or modify nftables rulesets to target catchall elements
3. Trigger repeated flush operations on affected sets
4. Observe progressive memory consumption until system impact occurs

How to detect it

Review kernel memory usage trends correlated with nftables configuration changes; inspect system logs for repeated nf_tables API calls involving catchall sets.

What your security team should do

• Schedule kernel updates to include the referenced commit across all Linux fleets
• Limit untrusted local user access to nftables administration where possible
• Monitor EPSS and KEV status for any future increase in exploit activity