CVE-2023-52924

What it actually does

Asymmetry between commit/abort and preparation phases for verdict-map sets with timeouts allows expired elements to be skipped during set walks, leaving chain use counts unchanged; subsequent element destruction via nf_tables_set_elem_destroy leaks the nft_chain structure and triggers WARN splats on chain removal, manifesting as a use-after-free condition.

Why it matters to the business

Unpatched systems may experience kernel warnings, memory leaks, and potential instability or crashes when nftables sets with timeouts are removed, increasing operational risk and requiring urgent kernel updates especially given ongoing Linux kernel exploitation activity by espionage and financially motivated actors.

How an attack unfolds

An attacker crafts a verdict-map set with timeouts, inserts an element referencing a chain, allows the element to expire, then triggers set removal; the kernel's walk skips the expired element so the chain use count is not adjusted, and later destruction leaks the chain object, enabling follow-on use-after-free abuse for privilege escalation.

How to fix it

Upgrade the Linux kernel to a release containing commit 4b7011b70d5718728ff912d02a4dbdc7f703540d (or equivalent backport) that updates pipapo_get() to stop skipping expired elements; rebuild and reboot affected systems; if immediate patching is impossible, restrict unprivileged nftables access via capabilities or seccomp.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit history or kernel version strings; exercise nftables set creation, expiration, and removal under timeout conditions while monitoring dmesg for absence of the previous WARN splat; verify no nft_chain reference leaks via kmemleak or similar tooling.

Typical attack path

1. Create verdict-map nftables set with timeout enabled
2. Insert element referencing a target chain
3. Allow element to expire naturally
4. Request removal of the parent set from userspace
5. Kernel performs set walks that skip the expired element
6. Element destruction leaks chain use count
7. Chain removal triggers WARN and potential UAF

How to detect it

Search kernel logs for WARN splats referencing nft_chain use counts or nf_tables_set_elem_destroy; inspect audit logs for sequences of nft set creation, element insertion with timeout, and set removal commands; look for unexpected chain reference leaks via kmemleak reports or slabinfo anomalies after nftables operations.

What your security team should do

• Prioritize kernel upgrade within the next 30 days given public exploitation of similar Linux kernel issues
• Audit systems for active nftables verdict maps that use timeouts
• Apply least-privilege restrictions on nftables netlink access
• Enable kernel hardening features such as CONFIG_SLAB_FREELIST_RANDOM and page-table isolation
• Monitor for new EPSS increases or KEV inclusion